Hi,

Hi,
it appears there is a bug in Github Copilot App. The same setup is working with VScode. But we are experiencing issues with the app. Here are the respective findings:
We have enough information to identify a **GitHub Copilot App v1.1.14 OAuth compatibility issue**.

VS Code uses only:

```json
{
"url": "https://mcp.skyway.porsche.com/mcp",
"type": "http"
}
```

It successfully discovers:

```text
/.well-known/oauth-protected-resource/mcp
/.well-known/oauth-authorization-server
```

The Copilot App instead logs:

```text
OAuthChallenge { www_authenticate_header: "" }
HTTP 403 Forbidden
```

The MCP server’s initial `401` response lacks the required header:

```http
WWW-Authenticate: Bearer resource_metadata="https://mcp.skyway.porsche.com/.well-known/oauth-protected-resource/mcp"
```

VS Code compensates by discovering the path-specific metadata itself; Copilot App/rmcp does not, then its fallback request is blocked by the WAF.

**Relevant files:**

- VS Code config: `%APPDATA%\Code\User\mcp.json`
- VS Code MCP log: `%APPDATA%\Code\logs\20260827T081750\window2\mcpServer.mcp.config.usrlocal.my-mcp-server-3fd8acd9.log`
- Copilot config: `%USERPROFILE%\.copilot\mcp-config.json`
- Copilot runtime logs: `%USERPROFILE%\.copilot\logs\process-*.log`
- Copilot UI logs: `%USERPROFILE%\.copilot\logs\github-app.*.log`

For a bug report, include the above excerpts, Copilot App **1.1.14**, VS Code **1.133.0**, and note that VS Code discovers nine tools successfully with the same URL. Do not include tokens, authorization codes, cookies, or complete authorization URLs.

The server team can resolve compatibility by adding the `WWW-Authenticate` header. Alternatively, the Copilot App must support path-derived RFC 9728 discovery when that header is absent.

---
| Field | Value |
| --- | --- |
| App version | 1.1.14 |
| OS | Windows 10.0.22631 |
| Theme | GitHub |
| Path | /chat |
| Tenure | Week 2 |

首先，将 %USERPROFILE%\.copilot\mcp-config.json 中的 Copilot 配置及其运行时日志与正常工作的 VS Code 配置和 MCP 日志进行比较。重新发起对指定 MCP URL 的请求，并验证 401/403 响应以及缺少 WWW-Authenticate 标头的情况。确认兼容性问题属于 Copilot App 发现过程还是 MCP 服务器响应，并记录预期行为，即视为完成。

由索引模型根据 Issue 内容生成。