Hi,

Hi,
it appears there is a bug in Github Copilot App. The same setup is working with VScode. But we are experiencing issues with the app. Here are the respective findings:
We have enough information to identify a **GitHub Copilot App v1.1.14 OAuth compatibility issue**.

VS Code uses only:

```json
{
"url": "https://mcp.skyway.porsche.com/mcp",
"type": "http"
}
```

It successfully discovers:

```text
/.well-known/oauth-protected-resource/mcp
/.well-known/oauth-authorization-server
```

The Copilot App instead logs:

```text
OAuthChallenge { www_authenticate_header: "" }
HTTP 403 Forbidden
```

The MCP server’s initial `401` response lacks the required header:

```http
WWW-Authenticate: Bearer resource_metadata="https://mcp.skyway.porsche.com/.well-known/oauth-protected-resource/mcp"
```

VS Code compensates by discovering the path-specific metadata itself; Copilot App/rmcp does not, then its fallback request is blocked by the WAF.

**Relevant files:**

- VS Code config: `%APPDATA%\Code\User\mcp.json`
- VS Code MCP log: `%APPDATA%\Code\logs\20260827T081750\window2\mcpServer.mcp.config.usrlocal.my-mcp-server-3fd8acd9.log`
- Copilot config: `%USERPROFILE%\.copilot\mcp-config.json`
- Copilot runtime logs: `%USERPROFILE%\.copilot\logs\process-*.log`
- Copilot UI logs: `%USERPROFILE%\.copilot\logs\github-app.*.log`

For a bug report, include the above excerpts, Copilot App **1.1.14**, VS Code **1.133.0**, and note that VS Code discovers nine tools successfully with the same URL. Do not include tokens, authorization codes, cookies, or complete authorization URLs.

The server team can resolve compatibility by adding the `WWW-Authenticate` header. Alternatively, the Copilot App must support path-derived RFC 9728 discovery when that header is absent.

---
| Field | Value |
| --- | --- |
| App version | 1.1.14 |
| OS | Windows 10.0.22631 |
| Theme | GitHub |
| Path | /chat |
| Tenure | Week 2 |

まず、%USERPROFILE%\.copilot\mcp-config.json の Copilot 設定とそのランタイムログを、動作している VS Code 設定および MCP ログと比較します。指定された MCP URL へのリクエストを再現し、401/403 レスポンスと WWW-Authenticate ヘッダーがないことを確認します。Copilot App の検出に互換性の問題があるのか、MCP サーバーのレスポンスにあるのかを確認し、期待される動作を文書化できれば完了です。

索引モデルが issue の本文から書いたものです。