MCP startup suggests codex mcp login for bearer-token auth failures

Open 💬 2 comments Opened Jun 6, 2026 by sanjumsanthosh

What version of Codex CLI is running?

0.137.0

What subscription do you have?

Enterprise

Which model were you using?

gpt-5.5

What platform is your computer?

Darwin 25.5.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

iTerm2

Codex doctor report

What issue are you seeing?

Codex currently shows misleading remediation for some MCP startup auth failures.

For remote MCP servers configured with bearer_token_env_var, a startup failure that contains Auth required is currently surfaced as:

Codex currently shows misleading remediation for some MCP startup auth failures.

That message reads like an OAuth-login problem, but for bearer-token-configured servers the real issue is more likely that the configured token is missing, expired, invalid, or rejected by the server.

https://github.com/openai/codex/blob/87b808bb570f01f4b6fc8485c5459052fac0e320/codex-rs/codex-mcp/src/connection_manager.rs#L811-L852

So any startup error containing Auth required gets mapped to the codex mcp login hint, even when the server is configured to use bearer-token auth.

What steps can reproduce the bug?

Configure a remote MCP server with bearer_token_env_var in ~/.codex/config.toml.
Set that environment variable to a bearer token value.
Make the token invalid for the server, for example by using an expired or rejected token.
Start Codex or trigger MCP server startup.
Observe that Codex reports the server as “not logged in” and suggests codex mcp login <server> instead of pointing to the configured bearer token as the likely source of the failure.

What is the expected behavior?

_No response_

Additional information

_No response_

View original on GitHub ↗

2 Comments

xinyu-dev · 2 months ago

Same here

Necmttn · 2 months ago

The remediation branch can probably key off the configured auth mode before looking at the error text.

If the MCP server has bearer_token_env_var, an Auth required startup failure should name the server and env var, for example:

MCP server <name> rejected bearer-token auth.
Check that <ENV_VAR> is set and accepted by the server.

Only servers configured for OAuth should point users at codex mcp login <server>. A regression test can cover the same response body under both auth modes so the generic substring match does not override the configured credential type.

---

_Generated with ax._