openai/codex · error · ConfigManagerError

{context}: {source}

Error message

{context}: {source}

What it means

codex mcp-server explicitly refuses to start when workload identity auth is selected (codex_login::is_workload_identity_selected()), raising ErrorKind::Unsupported (codex-rs/mcp-server/src/lib.rs:213). Workload-identity credential chains are not implemented for the MCP server execution path, so it fails fast instead of running unauthenticated or breaking later mid-request.

Source

Thrown at codex-rs/app-server/src/config_manager_service.rs:52

use codex_utils_absolute_path::AbsolutePathBuf;
use serde_json::Value as JsonValue;
use std::borrow::Cow;
use std::path::Path;
use std::path::PathBuf;
use thiserror::Error;
use tokio::task;
use toml::Value as TomlValue;
use toml_edit::Item as TomlItem;

#[derive(Debug, Error)]
pub(crate) enum ConfigManagerError {
    #[error("{message}")]
    Write {
        code: ConfigWriteErrorCode,
        message: String,
    },

    #[error("{context}: {source}")]
    Io {
        context: &'static str,
        #[source]
        source: std::io::Error,
    },

    #[error("{context}: {source}")]
    Json {
        context: &'static str,
        #[source]
        source: serde_json::Error,
    },

    #[error("{context}: {source}")]
    Toml {
        context: &'static str,
        #[source]
        source: toml::de::Error,

View on GitHub (pinned to 339751715c)

Solutions

1. Switch the MCP server's auth to a supported mode: remove the workload identity selection from config/env and use API-key or ChatGPT login auth.
2. Run the mcp-server under a separate CODEX_HOME / config profile without workload identity.
3. If workload identity is required, use an execution surface that supports it instead of codex mcp-server.

if codex_login::is_workload_identity_selected() {
    return Err(anyhow::anyhow!(
        "workload identity is unsupported here; switch auth mode before starting"
    ));
}

match run_main(args, overrides, strict).await {
    Err(e) if e.kind() == std::io::ErrorKind::Unsupported => {
        // fail with guidance to switch auth mode; do not retry
    }
    other => other,
}

When it happens

Trigger: Launching `codex mcp-server` while the environment or config selects workload identity as the auth method — for example a container or CI image configured for workload-identity CLI runs reused to host the MCP server.

Common situations: CI images exporting workload identity settings globally; copying config.toml between machine roles; a machine configured for workload identity also trying to run the MCP server.

Related errors

• {message}
• current-time request timed out after {}s
• InvalidInput
• could not resolve the Luna model provider: {0}
• creating HTTP server: {err}

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/c071e62657008916. Report an issue: GitHub.