Codex rejects New Relic Streamable HTTP MCP OAuth metadata

What version of Codex CLI is running?

codex-cli 0.151.0

What subscription do you have?

ChatGPT subscription.

Which model were you using?

gpt-5.5

What platform is your computer?

macOS 26.6.1, Darwin 25.6.0, arm64.

What terminal emulator and version are you using (if applicable)?

tmux 3.6a inside a terminal session.

Codex doctor report

Sanitized summary only:

Codex version: 0.151.0
Install method: brew cask
Platform: macos-aarch64
Auth: ChatGPT tokens configured
Config parse: ok
MCP servers configured: 6
New Relic MCP server configured as streamable_http at https://mcp.newrelic.com/mcp/

The full codex doctor --json also showed network reachability failures in the current sandboxed diagnostic context, so I am not treating those as primary evidence for this report.

What issue are you seeing?

Codex CLI cannot start the OAuth login flow for New Relic's official Streamable HTTP MCP endpoint.

The local Claude MCP config has New Relic configured and working as an HTTP MCP server:

"newrelic": {
  "type": "http",
  "url": "https://mcp.newrelic.com/mcp/"
}

Codex is configured with the equivalent supported stanza:

[mcp_servers.newrelic]
url = "https://mcp.newrelic.com/mcp/"

codex mcp get newrelic reports:

newrelic
  enabled: true
  transport: streamable_http
  url: https://mcp.newrelic.com/mcp/
  bearer_token_env_var: -
  http_headers: -
  env_http_headers: -
  http_headers_helper: -

However, attempting to log in fails before opening or completing the browser OAuth flow:

$ codex mcp login newrelic
Error: OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks

The same error occurs with explicit registration modes:

$ codex mcp login newrelic --oauth-client-registration dcr
Error: OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks

$ codex mcp login newrelic --oauth-client-registration cimd
Error: OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks

This appears to be a Codex MCP OAuth interoperability issue with New Relic's official remote MCP server, rather than a local config mismatch. Codex's source contains this exact validation error in codex-rs/rmcp-client/src/oauth/issuer_binding.rs.

What steps can reproduce the bug?

1. Configure New Relic as a remote MCP server:

   [mcp_servers.newrelic]
   url = "https://mcp.newrelic.com/mcp/"
   

2. Confirm Codex recognizes it as a streamable HTTP MCP server:

   codex mcp get newrelic
   

3. Attempt to authenticate:

   codex mcp login newrelic
   

4. Observe the OAuth origin validation failure before the login flow completes.

5. Optional: repeat with --oauth-client-registration dcr and --oauth-client-registration cimd; both fail the same way.

What is the expected behavior?

Codex should start and complete the browser OAuth flow for New Relic's official Streamable HTTP MCP server, or provide a supported configuration path that works with that server.

If New Relic's metadata is non-compliant with Codex's issuer-bound callback requirements, the error should ideally identify the relevant metadata fields and document the expected provider-side or client-side fix.

Additional information

A related issue exists for the same Codex OAuth validation error with another remote MCP provider: #41362. This report is New Relic-specific and was reproduced on macOS with Codex CLI 0.151.0.

No credentials, tokens, cookies, private keys, or raw local auth files are included in this report.

Start in codex-rs/rmcp-client/src/oauth/issuer_binding.rs, where the reported origin-validation error is defined, then reproduce with the New Relic URL and codex mcp login newrelic. Compare the server's OAuth metadata with the issuer-bound callback checks and related issue #41362; done means the supported login flow works or the relevant incompatibility and supported path are clearly identified.