Codex rejects Kit's official Streamable HTTP MCP OAuth metadata

What version of the Codex App are you using (From “About Codex” dialog)?

Codex App version unknown; bundled codex-cli 0.150.0-alpha.12.2

What subscription do you have?

ChatGPT subscription (exact tier unknown)

What platform is your computer?

Windows x64

What issue are you seeing?

Codex App cannot connect natively to Kit's official Streamable HTTP MCP endpoint at https://app.kit.com/mcp.

The browser OAuth flow fails before authorization with:

MCP startup failed: failed to resolve OAuth metadata before using stored credentials

OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks

The same endpoint works through native OAuth in Claude, Cursor, and ChatGPT custom apps. This appears to be a Codex-specific OAuth interoperability problem rather than a Streamable HTTP transport failure.

What steps can reproduce the bug?

1. In the Codex App, configure an MCP server with:
   url = "https://app.kit.com/mcp"
2. Restart Codex or run the MCP login flow.
3. Codex fetches Kit's OAuth metadata.
4. Startup/login fails before the Kit browser authorization page can complete.

Kit's current metadata uses:

• Resource endpoint: https://app.kit.com/mcp
• Authorization server / issuer: https://api.kit.com
• Authorization endpoint: https://app.kit.com/oauth/authorize
• Token endpoint: https://api.kit.com/oauth/token

Kit does not currently advertise issuer-bound authorization responses in its metadata.

What is the expected behavior?

Codex should open Kit's browser OAuth authorization flow and connect to the official Streamable HTTP MCP endpoint, as other native MCP clients do.

Additional information

Kit's official connection guide documents direct use of https://app.kit.com/mcp with browser OAuth and no bearer token or local bridge:
https://help.kit.com/en/articles/14827557-how-to-connect-the-kit-mcp-to-your-ai-tools

A third-party local stdio bridge works, but it should not be required for an officially supported remote MCP server. Please consider compatible handling for Kit's deployment without weakening Codex's issuer-validation security checks, or coordinate with Kit on RFC 9207 issuer-bound callback support.

Start by reproducing the MCP login flow against https://app.kit.com/mcp and inspect the OAuth metadata resolution path described in the report. Trace how Codex handles the https://api.kit.com authorization server and https://app.kit.com/oauth/authorize endpoint; done means the browser OAuth flow connects successfully without weakening issuer-validation security checks.