Lovable MCP OAuth discovery fails before browser: missing protected resource field

Summary

Codex Desktop and its bundled CLI cannot authenticate to Lovable's official Streamable HTTP MCP server. The OAuth flow fails before a browser or authorization URL is opened.

Environment

• Codex Desktop: 26.825.3734.0
• Bundled CLI: codex-cli 0.150.0-alpha.12.2 (Windows ARM64)
• OS: Windows 11
• MCP server URL: https://mcp.lovable.dev
• Configuration: project-scoped .codex/config.toml, auth = "oauth", server enabled

Expected behavior

codex mcp login lovable should start the OAuth browser flow and store credentials, as documented for OAuth-capable remote MCP servers.

Actual behavior

The command exits before opening a browser:

Error: Metadata error: Protected resource metadata missing required resource field

The same result occurs with the default registration strategy and with both explicit alternatives:

codex mcp login lovable
codex mcp login lovable --oauth-client-registration dcr
codex mcp login lovable --oauth-client-registration cimd

The Codex Desktop MCP UI lists the server as enabled but its controls/tools remain unavailable. Desktop logs mark startup as failed because the server is not logged in.

Independent endpoint checks

Unauthenticated checks of the public server return the expected OAuth discovery data:

• POST https://mcp.lovable.dev with an MCP initialize request returns 401 Unauthorized and:

  WWW-Authenticate: Bearer realm="mcp", resource_metadata="https://mcp.lovable.dev/.well-known/oauth-protected-resource"
  

• GET https://mcp.lovable.dev/.well-known/oauth-protected-resource returns JSON containing:

  {
    "resource": "https://mcp.lovable.dev",
    "authorization_servers": ["https://lovable.dev/oauth"]
  }
  

Adding oauth_resource = "https://mcp.lovable.dev" to the MCP configuration did not change the error.

Reproduction

1. Configure the Lovable endpoint as an enabled streamable HTTP MCP server with OAuth.
2. Run codex mcp login lovable.
3. Observe the metadata error before any browser login begins.

No credentials, user identifiers, project identifiers, or private logs are included in this report.

Start at the codex mcp login lovable entry point and trace protected-resource metadata handling for the Streamable HTTP OAuth flow. Reproduce against https://mcp.lovable.dev and compare the parsed response with its resource field; done means the metadata is accepted and the browser authorization flow starts for the documented configuration.