Add `--oauth [URL]` to codex mcp add for configuring OAuth resource

What variant of Codex are you using?

CLI

What feature would you like to see?

I would like codex mcp add to support configuring oauth_resource directly for streamable HTTP MCP servers.

Today, some authenticated MCP servers require an OAuth resource indicator, but codex mcp add <name> --url <url> only writes the url entry. Users then have to manually edit ~/.codex/config.toml to add:

[mcp_servers.example]
url = "https://mcp-gateway.example.net/example-mcp"
oauth_resource = "https://mcp-gateway.example.net/example-mcp"

A concrete class of affected setups is authenticated remote MCP servers hosted behind a gateway, where the OAuth resource indicator matches the MCP server URL and must be present in config before codex mcp login <name> works as expected.

Suggested CLI shape:

codex mcp add <name> --url <url> --oauth
codex mcp add <name> --url <url> --oauth <resource-url>

Proposed behavior:

• --oauth writes oauth_resource = <url>
• --oauth <resource-url> writes oauth_resource = <resource-url>
• no --oauth preserves current behavior

This would make the common case much easier while still supporting deployments where the OAuth resource URI differs from the MCP server URL.

Additional information

This is related to existing MCP OAuth/resource discussions such as #12589 and #20729, but the request here is specifically about improving the CLI setup ergonomics for codex mcp add, since oauth_resource already exists in config today.

I already prototyped this locally and the change is small:

• add an HTTP-only --oauth [URL] flag to codex mcp add
• default bare --oauth to the MCP --url
• persist the resolved value as oauth_resource
• pass it through the existing add-time OAuth login path
• cover the bare flag, explicit URL, and stdio rejection cases with CLI tests

Happy to share the patch or implementation notes if the team wants to pursue this direction.

PS: I attempted to create a PR but didn't have privileges so instead created a demo at https://github.com/luciomartinez/codex/pull/1