Hosted Tableau MCP OAuth fails due to Codex loopback redirect/client metadata behavior

Summary

Codex cannot complete OAuth for Tableau's hosted MCP server (https://mcp.tableau.com) in an SSO-enabled Tableau Cloud site, while Claude Code can complete OAuth against the same Tableau site and same hosted MCP server.

This appears related to Codex's OAuth redirect URI shape and/or lack of a Tableau-compatible public OAuth client metadata document.

Environment

• Codex CLI: codex-cli 0.142.4
• Codex surface: Codex desktop app / bundled CLI
• OS: macOS
• MCP server: Tableau hosted MCP, https://mcp.tableau.com
• Tableau Cloud site uses SSO/MFA and requires Tableau's site URI selection step
• Comparison client: Claude Code 2.1.205

Tableau / MCP OAuth metadata observed

Tableau hosted MCP advertises OAuth protected-resource metadata:

• Resource: https://mcp.tableau.com
• Authorization server: https://sso.online.tableau.com

The Tableau authorization server metadata includes:

• authorization_endpoint: https://sso.online.tableau.com/oauth2/authorize
• token_endpoint: https://sso.online.tableau.com/oauth2/token
• grant_types_supported: authorization_code, refresh_token
• code_challenge_methods_supported: S256
• client_id_metadata_document_supported: true

What works

Claude Code can authenticate to the same hosted Tableau MCP server and site.

Claude Code's claude mcp login --no-browser tableau-hosted generated an authorize URL using a public OAuth client metadata document as the client ID:

client_id=https://claude.ai/oauth/claude-code-client-metadata
redirect_uri=http://localhost:{port}/callback
resource=https://mcp.tableau.com/

That client metadata document returns:

{
  "client_id": "https://claude.ai/oauth/claude-code-client-metadata",
  "client_name": "Claude Code",
  "client_uri": "https://claude.ai",
  "redirect_uris": [
    "http://localhost/callback",
    "http://127.0.0.1/callback"
  ],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none"
}

The user can complete the Tableau SSO/MFA flow in Claude Code and use hosted Tableau MCP tools.

What fails in Codex

Initial Codex setup without a client ID fails because Tableau hosted MCP does not support dynamic client registration:

Dynamic client registration not supported

When configuring Codex with a Tableau Connected App client ID, Codex generates an OAuth URL but the browser flow loses the OAuth context at Tableau's site URI selection step. The user sees:

1. Tableau login screen prompts for username.
2. Tableau site URI screen at sso.online.tableau.com/public/prelogin/siteURI?....
3. MFA screen.
4. User is logged into Tableau normally, but no redirect returns to Codex's localhost callback.

The site URI page URL no longer contains the original OAuth request context such as redirect_uri, state, resource, or client_id.

We then configured Codex with the same client metadata URL that Claude Code uses:

codex mcp add tableau-hosted \
  --url https://mcp.tableau.com \
  --oauth-client-id https://claude.ai/oauth/claude-code-client-metadata

Codex generated an authorize URL with the same client_id, but a different redirect URI shape:

client_id=https://claude.ai/oauth/claude-code-client-metadata
redirect_uri=http://127.0.0.1:{port}/callback/{random}
resource=https://mcp.tableau.com/

This still fails in the same way. The OAuth context is lost during Tableau SSO/site URI selection and Codex remains Not logged in.

Expected behavior

Codex should be able to complete OAuth with MCP servers that use OAuth 2.1 and Client ID Metadata Documents, including Tableau hosted MCP.

In particular, Codex likely needs one or both of:

• A public Codex OAuth client metadata document whose redirect_uris match the loopback callback shape Codex actually generates.
• A Tableau-compatible loopback redirect URI shape, for example http://localhost:{port}/callback or http://127.0.0.1:{port}/callback, without an undeclared/random path segment.

Why this looks Codex-specific

• Claude Code hosted MCP OAuth succeeds against the same Tableau site and SSO flow.
• Codex local MCP works when using Tableau's local MCP server with direct-trust Connected App credentials.
• The remaining failure is specific to Codex's hosted MCP OAuth flow and redirect/client metadata behavior.

Additional note

For the same Tableau site, running the Tableau MCP server locally via stdio with AUTH=direct-trust works in Codex. A direct MCP smoke test successfully called list-datasources and returned Tableau datasources. So the Tableau site, user, connected app permissions, and local MCP plumbing are functional.