Hi,

Hi,
it appears there is a bug in Github Copilot App. The same setup is working with VScode. But we are experiencing issues with the app. Here are the respective findings:
We have enough information to identify a **GitHub Copilot App v1.1.14 OAuth compatibility issue**.

VS Code uses only:

```json
{
"url": "https://mcp.skyway.porsche.com/mcp",
"type": "http"
}
```

It successfully discovers:

```text
/.well-known/oauth-protected-resource/mcp
/.well-known/oauth-authorization-server
```

The Copilot App instead logs:

```text
OAuthChallenge { www_authenticate_header: "" }
HTTP 403 Forbidden
```

The MCP server’s initial `401` response lacks the required header:

```http
WWW-Authenticate: Bearer resource_metadata="https://mcp.skyway.porsche.com/.well-known/oauth-protected-resource/mcp"
```

VS Code compensates by discovering the path-specific metadata itself; Copilot App/rmcp does not, then its fallback request is blocked by the WAF.

**Relevant files:**

- VS Code config: `%APPDATA%\Code\User\mcp.json`
- VS Code MCP log: `%APPDATA%\Code\logs\20260827T081750\window2\mcpServer.mcp.config.usrlocal.my-mcp-server-3fd8acd9.log`
- Copilot config: `%USERPROFILE%\.copilot\mcp-config.json`
- Copilot runtime logs: `%USERPROFILE%\.copilot\logs\process-*.log`
- Copilot UI logs: `%USERPROFILE%\.copilot\logs\github-app.*.log`

For a bug report, include the above excerpts, Copilot App **1.1.14**, VS Code **1.133.0**, and note that VS Code discovers nine tools successfully with the same URL. Do not include tokens, authorization codes, cookies, or complete authorization URLs.

The server team can resolve compatibility by adding the `WWW-Authenticate` header. Alternatively, the Copilot App must support path-derived RFC 9728 discovery when that header is absent.

---
| Field | Value |
| --- | --- |
| App version | 1.1.14 |
| OS | Windows 10.0.22631 |
| Theme | GitHub |
| Path | /chat |
| Tenure | Week 2 |

Start by comparing the Copilot configuration in %USERPROFILE%\.copilot\mcp-config.json and its runtime logs with the working VS Code configuration and MCP log. Reproduce the request to the stated MCP URL and verify the 401/403 responses and missing WWW-Authenticate header. Done means confirming whether the compatibility issue belongs to Copilot App discovery or the MCP server response, with the expected behavior documented.

Vom Indexierungsmodell aus dem Issue-Text verfasst.