Streamable HTTP MCP server is shown as enabled/authenticated, but agent tool layer cannot use it

I configured a Streamable HTTP MCP server in Codex Desktop:

[mcp_servers.zread]
url = "https://open.bigmodel.cn/api/mcp/zread/mcp"
bearer_token_env_var = "ZHIPU_API_KEY"
startup_timeout_sec = 30
tool_timeout_sec = 120

The environment variable ZHIPU_API_KEY is present.

codex mcp get zread shows the server correctly:

• enabled: true
• transport: streamable_http
• bearer_token_env_var: ZHIPU_API_KEY
• status/auth appear normal in the Codex MCP UI

However, the agent cannot use this MCP server as native tools.

Attempts to access it through the agent-side MCP client fail with:

resources/list failed: failed to get client:
MCP startup failed:
handshaking with MCP server failed:
Send message error Transport [...]
Transport channel closed, when send initialized notification

Also, tool discovery does not expose the server tools:

• search_doc
• read_file
• get_repo_structure

tool_search returns 0 tools for zread.

I verified that the MCP server itself is working by manually calling the Streamable HTTP endpoint:

1. POST initialize
2. Read mcp-session-id from response headers
3. POST notifications/initialized with mcp-session-id
4. POST tools/list

Manual MCP HTTP calls successfully return:

['search_doc', 'read_file', 'get_repo_structure']

Manual tools/call also works. I tested:

• get_repo_structure on farion1231/cc-switch
• read_file on package.json and README.md
• search_doc with a Chinese query

All returned valid results.

So the issue does not seem to be the remote MCP server, the API key, or the Streamable HTTP endpoint. The issue appears to be between Codex Desktop/CLI showing the MCP as enabled and the agent runtime/tool layer failing to initialize or expose the server tools.

Expected behavior:
If codex mcp get zread shows the server as enabled and authenticated, the agent should be able to discover and call the remote MCP tools.

Actual behavior:
The MCP server appears enabled/authenticated in Codex, but agent-side native MCP calls fail at notifications/initialized, and the tools are not exposed.