›_ Codex Issues
Codex Issues / #37830

CLI MCP login fails for Grafana Cloud MCP because OAuth probe omits MCP Accept header

Open 💬 1 comment Opened Aug 10, 2026 by matteocontrini

What version of Codex CLI is running?

codex-cli 0.147.0

What platform is your computer?

Darwin 25.5.0 arm64 arm

What issue are you seeing?

codex mcp login grafana fails during OAuth metadata discovery for Grafana Cloud's hosted MCP server with the following error:

Error: Metadata error: OAuth metadata discovery failed for https://mcp.grafana.com/mcp
  Caused by: OAuth discovery redirect to non-same-origin URL rejected:
  https://grafana.com/docs/grafana-cloud/machine-learning/assistant/configure/cloud-mcp/

The reason is that codex mcp login performs its initial probe without the Accept header. It encounters the redirect to grafana.com and correctly rejects that cross-origin redirect during security-sensitive OAuth discovery.

What steps can reproduce the bug?

  • codex mcp add --url https://mcp.grafana.com/mcp grafana
  • codex mcp login grafana

What is the expected behavior?

codex mcp login proceeds with metadata discovery and launches the OAuth authorization process.

Additional information

Grafana currently behaves like this:

  • Plain GET https://mcp.grafana.com/mcp → 302 redirect to Grafana documentation.
  • The same request with Accept: application/json, text/event-stream → correct 401 OAuth challenge.
  • Grafana’s OAuth metadata endpoints themselves return valid JSON.

codex mcp login performs its initial probe without the MCP Accept header. It encounters the redirect to
grafana.com and correctly rejects that cross-origin redirect during security-sensitive OAuth discovery.

A plain request reproduces the redirect:

curl -I https://mcp.grafana.com/mcp
# HTTP 302, Location: https://grafana.com/docs/...

When the MCP Accept header is supplied, Grafana returns the expected OAuth challenge:

curl -I \
  -H 'Accept: application/json, text/event-stream' \
  https://mcp.grafana.com/mcp
# HTTP 401
# WWW-Authenticate: Bearer resource_metadata="https://mcp.grafana.com/.well-known/oauth-protected-resource/
mcp"

The proper fix is for Codex’s OAuth discovery probe to send the MCP accept types.

Workaround:

[mcp_servers.grafana]
url = "https://mcp.grafana.com/mcp"
http_headers = {
  "X-Grafana-URL" = "https://your-stack.grafana.net",
  "Accept" = "application/json, text/event-stream"
}

View original on GitHub ↗

1 Comment

jdcodes1 · 9 days ago

Confirming the asymmetry in the client: the streamable-HTTP transport path always negotiates properly — http_client_adapter.rs sends Accept: application/json, text/event-stream on MCP requests (EVENT_STREAM_MIME_TYPE, https://github.com/openai/codex/blob/1f41cc5d92/codex-rs/rmcp-client/src/http_client_adapter.rs#L67) — but the OAuth login flow's initial probe (the request whose 401 challenge seeds metadata discovery, via OauthLoginFlow::new → oauth_http_client.rs) issues a plain GET without those headers. Per the MCP spec that Accept header is required on requests to the MCP endpoint, so Grafana answering un-negotiated browser-ish traffic with a docs redirect is defensible content negotiation, and codex's cross-origin-redirect rejection is also correct — the bug is only that the probe doesn't identify itself as an MCP client.

Fix: apply the same default Accept headers (and arguably the configured http_headers/env_http_headers, which the flow already threads through for auth) to the discovery probe request. That makes the probe spec-compliant and turns Grafana's response back into the 401 + WWW-Authenticate the discovery code expects.