Hi,

Hi,
it appears there is a bug in Github Copilot App. The same setup is working with VScode. But we are experiencing issues with the app. Here are the respective findings:
We have enough information to identify a **GitHub Copilot App v1.1.14 OAuth compatibility issue**.

VS Code uses only:

```json
{
"url": "https://mcp.skyway.porsche.com/mcp",
"type": "http"
}
```

It successfully discovers:

```text
/.well-known/oauth-protected-resource/mcp
/.well-known/oauth-authorization-server
```

The Copilot App instead logs:

```text
OAuthChallenge { www_authenticate_header: "" }
HTTP 403 Forbidden
```

The MCP server’s initial `401` response lacks the required header:

```http
WWW-Authenticate: Bearer resource_metadata="https://mcp.skyway.porsche.com/.well-known/oauth-protected-resource/mcp"
```

VS Code compensates by discovering the path-specific metadata itself; Copilot App/rmcp does not, then its fallback request is blocked by the WAF.

**Relevant files:**

- VS Code config: `%APPDATA%\Code\User\mcp.json`
- VS Code MCP log: `%APPDATA%\Code\logs\20260827T081750\window2\mcpServer.mcp.config.usrlocal.my-mcp-server-3fd8acd9.log`
- Copilot config: `%USERPROFILE%\.copilot\mcp-config.json`
- Copilot runtime logs: `%USERPROFILE%\.copilot\logs\process-*.log`
- Copilot UI logs: `%USERPROFILE%\.copilot\logs\github-app.*.log`

For a bug report, include the above excerpts, Copilot App **1.1.14**, VS Code **1.133.0**, and note that VS Code discovers nine tools successfully with the same URL. Do not include tokens, authorization codes, cookies, or complete authorization URLs.

The server team can resolve compatibility by adding the `WWW-Authenticate` header. Alternatively, the Copilot App must support path-derived RFC 9728 discovery when that header is absent.

---
| Field | Value |
| --- | --- |
| App version | 1.1.14 |
| OS | Windows 10.0.22631 |
| Theme | GitHub |
| Path | /chat |
| Tenure | Week 2 |

Inizia confrontando la configurazione di Copilot in %USERPROFILE%\.copilot\mcp-config.json e i relativi log di runtime con la configurazione funzionante di VS Code e il log MCP. Riproduci la richiesta all’URL MCP indicato e verifica le risposte 401/403 e l’assenza dell’header WWW-Authenticate. Il lavoro è completo quando viene confermato se il problema di compatibilità riguarda il rilevamento da parte di Copilot App o la risposta del server MCP, con il comportamento previsto documentato.

Scritto dal modello di indicizzazione a partire dal testo della issue.