mcp-search fails after clean reinstall on Windows: ChatGPT backend plugin/connectors requests return Cloudflare 403, Settings UI also breaks

Summary

mcp-search fails to start in Codex after a full reinstall of both the CLI and desktop app. The failure occurs during MCP initialization:

MCP client for `mcp-search` failed to start: MCP startup failed: handshaking with MCP server failed: connection closed: initialize response
MCP startup incomplete (failed: mcp-search)

This still happens after:

• uninstalling Codex CLI
• uninstalling the Codex app
• deleting C:\Users\Gabriel Duarte Viera\.codex
• reinstalling everything
• restarting Windows

Environment

• OS: Windows
• Terminal: PowerShell
• Codex CLI version: 0.128.0
• Auth mode: chatgpt
• ChatGPT plan in token payload: plus
• Date observed: 2026-05-01

Observed behavior

The local auth state is recreated successfully after reinstall, but remote plugin/app discovery calls fail with 403 Forbidden and return a Cloudflare challenge page instead of JSON.

The observed pattern is:

1. Codex attempts remote plugin/app sync.
2. Requests to chatgpt.com/backend-api/... return 403 Forbidden.
3. Response body is HTML for a Cloudflare challenge page with Enable JavaScript and cookies to continue.
4. Codex logs authentication/plugin sync warnings.
5. mcp-search fails during MCP handshake and never completes initialize.

A related UI failure also appears in the Settings screen. Instead of loading normally, Settings shows a generic error state in Spanish:

Ocurrió un error
Comprobar actualizaciones
Inténtalo nuevamente

This seems consistent with the same backend failure, because the app logs show repeated failures while loading apps/connectors state around the same time.

Log evidence

From C:\Users\Gabriel Duarte Viera\.codex\log\codex-tui.log:

2026-05-01T18:54:30.200393Z  WARN codex_core::plugins::manager: failed to warm featured plugin ids cache
error=remote plugin sync request to https://chatgpt.com/backend-api/plugins/featured failed with status 403 Forbidden

2026-05-01T18:54:35.534886Z  WARN codex_core::plugins::startup_sync: startup remote plugin sync failed; will retry on next app-server start error=chatgpt authentication required to sync remote plugins

2026-05-01T19:01:30.609783Z  WARN codex_tui::chatwidget: failed to load full apps list; falling back to installed apps snapshot: Failed to load apps: Request failed with status 403 Forbidden

2026-05-01T19:01:30.610234Z  WARN codex_core::session::turn: failed to load discoverable tool suggestions: request failed with status 403 Forbidden

2026-05-01T19:03:04.157103Z  WARN codex_core::plugins::startup_sync: startup remote plugin sync failed; will retry on next app-server start error=remote plugin sync request to https://chatgpt.com/backend-api/plugins/list failed with status 403 Forbidden

2026-05-01T19:19:50.464680Z  WARN codex_tui::chatwidget: failed to load full apps list; falling back to installed apps snapshot: Failed to load apps: Request failed with status 403 Forbidden

2026-05-01T19:19:54.847070Z  WARN codex_tui::chatwidget: failed to refresh apps list; retaining current apps snapshot: Failed to load apps: Request failed with status 403 Forbidden

The HTML body included in the log contains:

Enable JavaScript and cookies to continue

and Cloudflare challenge markers such as:

window._cf_chl_opt
/cdn-cgi/challenge-platform/
cZone: 'chatgpt.com'
cType: 'managed'

Additional local checks

• auth.json is recreated and contains valid-looking ChatGPT tokens after reinstall.
• No HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, or NO_PROXY variables were found in process, user, or machine environment.
• The issue persists after deleting .codex, so it does not appear to depend on stale local cache/config alone.

Why this looks like an upstream issue

This does not behave like a broken local install.

The clean reinstall regenerates auth state, but Codex background requests to:

• https://chatgpt.com/backend-api/plugins/featured
• https://chatgpt.com/backend-api/plugins/list
• https://chatgpt.com/backend-api/connectors/directory/list

receive Cloudflare challenge HTML instead of the expected API response. That strongly suggests the client path used for plugin/app discovery is being treated as bot/non-browser traffic or is missing whatever session/cookie path Cloudflare expects.

Because mcp-search depends on that discovery path, the MCP server exits before returning the initialize response, which surfaces as:

connection closed: initialize response

Reproduction steps

1. Install Codex CLI and Codex desktop app on Windows.
2. Sign in with ChatGPT.
3. Start Codex from terminal.
4. Observe startup warning:

MCP client for `mcp-search` failed to start

1. Check C:\Users\Gabriel Duarte Viera\.codex\log\codex-tui.log.
2. Observe 403 Forbidden responses from chatgpt.com/backend-api/plugins/... and .../connectors/... returning Cloudflare challenge HTML.

Expected behavior

• Remote plugin/app discovery endpoints should return valid API responses when the user is correctly signed in with ChatGPT.
• mcp-search should complete MCP initialization successfully.
• Clean reinstall should not reproduce the same startup failure if auth is valid.

Actual behavior

• Remote discovery endpoints return Cloudflare challenge HTML with 403 Forbidden.
• Codex logs plugin/auth sync warnings.
• mcp-search fails at startup and MCP initialization remains incomplete.
• The Settings UI can fall into a generic error state instead of loading account/app settings.

Related public issues

• #16808: Cloudflare challenge blocks plugin marketplace requests
• #10290: failed to load apps with 403 Forbidden

Suggested investigation

• Check whether the HTTP client used by desktop/CLI plugin discovery is missing auth cookies or headers required by chatgpt.com/backend-api.
• Check whether Cloudflare bot protection is incorrectly challenging Codex client requests on plugin/connectors endpoints.
• Check whether mcp-search should degrade gracefully when remote discovery fails instead of aborting MCP initialization.