Local reproduction on macOS, 2026-09-10. The official Meta endpoint is configured as Streamable HTTP:
[mcp_servers.meta_ads]
url = "https://mcp.facebook.com/ads"
enabled_tools = []
default_tools_approval_mode = "prompt"
Running codex mcp login meta_ads fails before browser login:
OAuth authorization endpoint origin does not match the authorization server origin without issuer-bound callbacks
Public Meta discovery metadata observed on 2026-09-10:
The same endpoint is shown as connected in Claude Desktop, with its tool catalog visible. No Claude credentials were copied and no authenticated Meta data query was performed in this investigation.
The official rust-v0.154.0 source still rejects this combination in codex-rs/rmcp-client/src/oauth/issuer_binding.rs. That release was inspected, not installed or executed. No Meta exception appears there. A pre-registered client does not by itself resolve the observed endpoint-origin mismatch.
Request: Please provide a supported Meta-compatible OAuth flow that preserves issuer validation, or coordinate RFC 9207 issuer-bound authorization response support with Meta. Please clarify whether a supported alternative authentication path exists for this endpoint.
Related reports (different historical failures; not proof of a fix):
Source inspected:
https://github.com/openai/codex/blob/rust-v0.154.0/codex-rs/rmcp-client/src/oauth/issuer_binding.rs
Local reproduction on macOS, 2026-09-10. The official Meta endpoint is configured as Streamable HTTP:
Running
codex mcp login meta_adsfails before browser login:Public Meta discovery metadata observed on 2026-09-10:
The same endpoint is shown as connected in Claude Desktop, with its tool catalog visible. No Claude credentials were copied and no authenticated Meta data query was performed in this investigation.
The official rust-v0.154.0 source still rejects this combination in codex-rs/rmcp-client/src/oauth/issuer_binding.rs. That release was inspected, not installed or executed. No Meta exception appears there. A pre-registered client does not by itself resolve the observed endpoint-origin mismatch.
Request: Please provide a supported Meta-compatible OAuth flow that preserves issuer validation, or coordinate RFC 9207 issuer-bound authorization response support with Meta. Please clarify whether a supported alternative authentication path exists for this endpoint.
Related reports (different historical failures; not proof of a fix):
Source inspected:
https://github.com/openai/codex/blob/rust-v0.154.0/codex-rs/rmcp-client/src/oauth/issuer_binding.rs