Robinhood Banking MCP OAuth blocked by issuer-bound callback origin validation

What issue are you seeing?

Codex CLI cannot start OAuth authentication for Robinhood's officially documented Banking MCP endpoint:

https://banking-agent.robinhood.com/mcp/banking

With the MCP configured, authentication fails immediately:

$ codex mcp login rh_creditcard
Error: OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks

The Codex CLI installation is via Homebrew.

Robinhood currently documents this Banking MCP endpoint as supported by both Codex and Codex CLI:

https://robinhood.com/us/en/support/articles/agentic-credit-card/#ConnectyourAIagent

Steps to reproduce

1. Add Robinhood Banking as a remote MCP server:

   codex mcp add rh_creditcard --url https://banking-agent.robinhood.com/mcp/banking
   

2. Attempt OAuth login:

   codex mcp login rh_creditcard
   

3. Codex exits with:

   Error: OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks
   

Expected behavior

Codex should be able to authenticate to Robinhood's officially documented Banking MCP endpoint, or provide a supported per-server configuration mechanism for this OAuth deployment without disabling issuer validation globally.

Additional information

Current Codex source performs this validation in:

codex-rs/rmcp-client/src/oauth/issuer_binding.rs

https://github.com/openai/codex/blob/main/codex-rs/rmcp-client/src/oauth/issuer_binding.rs

That code already contains a narrow compatibility exception for Robinhood's Trading MCP:

(
    "https://agent.robinhood.com/mcp/trading",
    "https://robinhood.com",
    "https://api.robinhood.com",
)

but there is no corresponding compatibility handling for the Banking endpoint.

I understand that the preferred long-term fix may be for Robinhood to support RFC 9207 issuer-bound authorization responses. However, since Robinhood explicitly documents Codex/Codex CLI as supported and Codex already has Robinhood-specific compatibility handling for the Trading MCP, it would be useful to clarify whether Banking needs the same temporary compatibility treatment or whether this should be resolved provider-side.

A scoped configuration override may also be preferable to adding more hard-coded provider exceptions; related feature request: #38944.

Related reports showing the same validation error with other official MCP providers:

• #41677 — New Relic
• #41362 — Kit

No credentials or tokens are included in this report.

Start in codex-rs/rmcp-client/src/oauth/issuer_binding.rs and compare the existing Robinhood Trading exception with the Banking MCP flow. Reproduce with the documented codex mcp add and codex mcp login commands, then review related issues #38944, #41677, and #41362. Done means the provider-side versus scoped compatibility approach is clarified and the Banking authentication behavior is covered.