Remote MCP: scopes_supported should be extracted from the protected resource metadata document

What version of Codex CLI is running?

0.116.0

What subscription do you have?

Enterprise

Which model were you using?

_No response_

What platform is your computer?

_No response_

What terminal emulator and version are you using (if applicable)?

_No response_

What issue are you seeing?

Hello team,

I believe there is an issue with https://github.com/openai/codex/pull/14419 as Codex extracts the scopes_supported value from the auth server metadata document (/.well-known/oauth-authorization-server) instead of the protected resource one (/.well-known/oauth-protected-resource).

The MCP specification states the following:

https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#scope-selection-strategy

If scope is not available, use all scopes defined in scopes_supported from the Protected Resource Metadata document, omitting the scope parameter if scopes_supported is undefined.

I am currently developing an MCP server and was testing the DCR flow with the Codex CLI. With this bug, the Codex MCP client is ignoring the scopes I am defining in /.well-known/oauth-protected-resource and thus creates an OAuth app with the wrong scopes.

What steps can reproduce the bug?

Define scopes_supported in /.well-known/oauth-protected-resource

What is the expected behavior?

scopes_supported is extracted from /.well-known/oauth-protected-resource

Additional information

_No response_