Feature Request: Support dynamic reloading of MCP HTTP headers on auth failure (401/403)

What feature would you like to see?

Context

I am using an MCP server that requires a custom authentication header (e.g., a Bearer token) defined in the config.toml. Currently, my configuration looks like this:

[mcp_servers.enterprise_mcp]
transport = "http"
url = "https://enterprise_[mcp-mcp.enterprisedomain.com/mcp](https://mcp-mcp.enterprisedomain.com/mcp)"
startup_timeout_sec = 30
[mcp_servers.enterprise_mcp.http_headers]
x-token = "Bearer {{token}}"

The Problem

The authentication tokens for my enterprise environment expire every 3 hours. When a token expires, the MCP connection fails. Although I can update the token in config.toml, the current session (Codex) does not detect this change or reload the connection parameters.

Current Workaround & Impact
To restore connectivity, I am forced to kill and restart the entire Codex session.

This causes a complete loss of chat context and history.

I have to start my workflow from scratch every 3 hours.

This creates significant friction and limits the usability of MCP for long-running tasks.

Proposed Solution
I would like to request a feature that handles authentication failures gracefully without killing the session. Specifically:

Detect Failure: If the MCP server responds with a 401 Unauthorized or 403 Forbidden.

Check Config: The system should check if config.toml has been modified since the last load.

Hot Reload: If the config has changed (e.g., a new token was pasted), automatically reload the MCP connection/headers.

User Prompt: If the config hasn't changed, prompt the user to update their credentials.

This would vastly improve the developer experience for users working with secure, short-lived token environments.

Thanks!

Additional information

_No response_