Codex CLI ignores rmcp implementation for scope selection (ignores RFC 6749, RFC 9872)

Current situation

Version: codex-cli 0.142.5

Codex CLI ignores scopes provided by MCP server that can decide to expose them with error in www-authenticate error response (RFC 6749), oauth2 resource metadata document (RFC 9872), oauth2 authorization server document (RFC 8414).

Codex CLI does use scopes with following priority:

1. Explicitly declared,
2. From config.toml,
3. Own discovery of oauth2 authorization server document.

It suppresses the official rmcp library evaluation that supports more than currently implemented search with RFC 8414.

Proposal

Remove custom logic for the RFC 8414 and utilize the rmcp capabilities which are more diverse to handle scopes selection when user did not provide them explicitly.

Impact

Broadens the surface where the implementers can provide expected scopes for their MCP servers.