Support scopes_supported from OAuth protected resource metadata in MCP

Resolved 💬 0 comments Opened Jan 8, 2026 by odedpeer Closed Mar 12, 2026

What version of Codex is running?

codex-cli 0.79.0

What subscription do you have?

Enterprise

Which model were you using?

_No response_

What platform is your computer?

Darwin 25.2.0 arm64 arm

What issue are you seeing?

I am adding my MCP server, which causes codex to trigger OIDC authentication, but the URL does not have scopes even though my protected resource metadata includes scopes_supported`

What steps can reproduce the bug?

add the MCP Server https://mcp.stage.oort.io
see it triggers authentication without scopes.

What is the expected behavior?

add space delimited values of scopes_supported to a scope query parameter in the URL

Additional information

_No response_

View original on GitHub ↗