openai/codex · error · anyhow::Error

MCP authorization server does not advertise CIMD with token

Error message

MCP authorization server does not advertise CIMD with token endpoint auth method `none`

What it means

Error "MCP authorization server does not advertise CIMD with token endpoint auth method `none`" thrown in openai/codex.

Source

Thrown at codex-rs/rmcp-client/src/oauth_client_registration.rs:79

            parsed_redirect_uri.host_str(),
            Some("127.0.0.1" | "localhost")
        )
        && parsed_redirect_uri.port().is_some_and(|port| port > 0)
        && parsed_redirect_uri.path() == format!("/callback/{callback_id}")
        && parsed_redirect_uri.query().is_none()
        && parsed_redirect_uri.fragment().is_none()
        && parsed_redirect_uri.username().is_empty()
        && parsed_redirect_uri.password().is_none();
    // MCP 2026-07-28 priority: pre-registered clients never reach this path; offer
    // advertised CIMD here and otherwise let rmcp fall back to DCR.
    // https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/client-registration
    let offer_cimd = match client_registration {
        McpOAuthClientRegistration::Auto => {
            cimd_advertised && native_redirect_supported && public_client_auth_supported
        }
        McpOAuthClientRegistration::Cimd => {
            if !cimd_advertised || !public_client_auth_supported {
                bail!(
                    "MCP authorization server does not advertise CIMD with token endpoint auth method `none`"
                );
            }
            if !native_redirect_supported {
                bail!(
                    "MCP OAuth CIMD requires an ephemeral loopback callback at `/callback/{callback_id}`"
                );
            }
            true
        }
        McpOAuthClientRegistration::Dcr => false,
    };

    auth_manager.set_metadata(metadata);
    let mut request = AuthorizationRequest::new(redirect_uri)
        .with_scopes(scopes.iter().copied())
        .with_client_name("Codex");
    if offer_cimd {

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/rmcp-client/src/oauth_client_registration.rs:79 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/4c5befb840b5d55d. Report an issue: GitHub.