{"record":{"id":"bf7084e63392d627","repo":"openai/codex","slug":"mcp-oauth-cimd-requires-an-ephemeral-loopback-call","errorCode":null,"errorMessage":"MCP OAuth CIMD requires an ephemeral loopback callback at `/callback/{callback_id}`","messagePattern":"MCP OAuth CIMD requires an ephemeral loopback callback at `/callback/(.+?)`","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/rmcp-client/src/oauth_client_registration.rs","lineNumber":84,"sourceCode":"        && parsed_redirect_uri.query().is_none()\n        && parsed_redirect_uri.fragment().is_none()\n        && parsed_redirect_uri.username().is_empty()\n        && parsed_redirect_uri.password().is_none();\n    // MCP 2026-07-28 priority: pre-registered clients never reach this path; offer\n    // advertised CIMD here and otherwise let rmcp fall back to DCR.\n    // https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/client-registration\n    let offer_cimd = match client_registration {\n        McpOAuthClientRegistration::Auto => {\n            cimd_advertised && native_redirect_supported && public_client_auth_supported\n        }\n        McpOAuthClientRegistration::Cimd => {\n            if !cimd_advertised || !public_client_auth_supported {\n                bail!(\n                    \"MCP authorization server does not advertise CIMD with token endpoint auth method `none`\"\n                );\n            }\n            if !native_redirect_supported {\n                bail!(\n                    \"MCP OAuth CIMD requires an ephemeral loopback callback at `/callback/{callback_id}`\"\n                );\n            }\n            true\n        }\n        McpOAuthClientRegistration::Dcr => false,\n    };\n\n    auth_manager.set_metadata(metadata);\n    let mut request = AuthorizationRequest::new(redirect_uri)\n        .with_scopes(scopes.iter().copied())\n        .with_client_name(\"Codex\");\n    if offer_cimd {\n        // CIMD is an active IETF Internet-Draft: this HTTPS client identifier resolves\n        // to its self-referential JSON metadata document.\n        // https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/\n        request = request.with_client_metadata_url(format!(\n            \"https://chatgpt.com/oauth/codex/{callback_id}/client.json\"","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/rmcp-client/src/oauth_client_registration.rs#L66-L102","documentation":"Error \"MCP OAuth CIMD requires an ephemeral loopback callback at `/callback/{callback_id}`\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/rmcp-client/src/oauth_client_registration.rs:84 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}