"OAuth discovery redirect to non-same-origin URL rejected" in Codex
Codex refuses to follow a redirect during OAuth discovery when it would leave the origin — a credential-leak guard. A server that answers the login probe with a 302 instead of a 401 trips it, and the message reads as if the server were misconfigured.
npx mcpcomp doctor https://mcp.example.com/mcpdoctor classifies the failing layer — discovery, authorization server, endpoint liveness, or client auth state — from outside, with no credentials.
What the error means
codex mcp login probes the server without Accept: application/json, text/event-stream. A server that content-negotiates — Grafana Cloud is the documented case — answers a browser-looking request with a 302 to its login page rather than a 401 with a WWW-Authenticate challenge. Codex's discovery client rejects the cross-origin redirect (openai/codex#37830, open at the time of writing). The same server works in clients that send the MCP Accept header.
How to diagnose it
Check what the server does to a credential-less request
MCPComp sends the Accept header a conformant client sends, so a content-negotiating server answers it 401 and passes — mcp.grafana.com grades A. A clean scan next to this Codex error is itself the diagnosis: the server is fine for clients that send the header, and the fault is the Codex login probe. A server that redirects even with the header is reported as inconclusive, with the redirect target printed.
Serve a 401 to unauthenticated MCP requests
Answer the MCP endpoint with 401 and a Bearer challenge carrying resource_metadata regardless of Accept. Keep browser redirects for the human-facing paths only.
Frequently asked questions
Is this a Codex bug or my server's?
Both have a part. The issue against Codex is open; until it lands, a server that 401s every unauthenticated MCP request works in every client, including Codex.