CLI MCP login fails for Grafana Cloud MCP because OAuth probe omits MCP Accept header

What version of Codex CLI is running?

codex-cli 0.147.0

What platform is your computer?

Darwin 25.5.0 arm64 arm

What issue are you seeing?

codex mcp login grafana fails during OAuth metadata discovery for Grafana Cloud's hosted MCP server with the following error:

Error: Metadata error: OAuth metadata discovery failed for https://mcp.grafana.com/mcp
  Caused by: OAuth discovery redirect to non-same-origin URL rejected:
  https://grafana.com/docs/grafana-cloud/machine-learning/assistant/configure/cloud-mcp/

The reason is that codex mcp login performs its initial probe without the Accept header. It encounters the redirect to grafana.com and correctly rejects that cross-origin redirect during security-sensitive OAuth discovery.

What steps can reproduce the bug?

• codex mcp add --url https://mcp.grafana.com/mcp grafana
• codex mcp login grafana

What is the expected behavior?

codex mcp login proceeds with metadata discovery and launches the OAuth authorization process.

Additional information

Grafana currently behaves like this:

• Plain GET https://mcp.grafana.com/mcp → 302 redirect to Grafana documentation.
• The same request with Accept: application/json, text/event-stream → correct 401 OAuth challenge.
• Grafana’s OAuth metadata endpoints themselves return valid JSON.

codex mcp login performs its initial probe without the MCP Accept header. It encounters the redirect to
grafana.com and correctly rejects that cross-origin redirect during security-sensitive OAuth discovery.

A plain request reproduces the redirect:

curl -I https://mcp.grafana.com/mcp
# HTTP 302, Location: https://grafana.com/docs/...

When the MCP Accept header is supplied, Grafana returns the expected OAuth challenge:

curl -I \
  -H 'Accept: application/json, text/event-stream' \
  https://mcp.grafana.com/mcp
# HTTP 401
# WWW-Authenticate: Bearer resource_metadata="https://mcp.grafana.com/.well-known/oauth-protected-resource/
mcp"

The proper fix is for Codex’s OAuth discovery probe to send the MCP accept types.

Workaround:

[mcp_servers.grafana]
url = "https://mcp.grafana.com/mcp"
http_headers = {
  "X-Grafana-URL" = "https://your-stack.grafana.net",
  "Accept" = "application/json, text/event-stream"
}

Start at the OAuth discovery probe used by codex mcp login and run the two listed curl requests to compare Grafana's responses with and without the MCP Accept header. Trace the probe's request construction, then verify that login reaches OAuth authorization for the Grafana MCP URL without weakening same-origin redirect checks.