Codex registers its MCP OAuth loopback callback without a port and adds the live port at sign-in: an authorization server that matches redirect URIs exactly refuses it; ignore only the port for loopback IP redirects, or have Codex register a fixed port

Fix

Server side: 1) For http redirect URIs on the loopback IP literals 127.0.0.1 and [::1], compare everything except the port exactly: scheme, user info, host, path, query (RFC 8252 7.3 and 8.4); keep exact matching for every other redirect URI. 2) Do not widen this to other hosts, to localhost or to https, and do not accept a malformed port. Client side, when you cannot change the server: 3) a fixed port only helps if the registered URI carries it, so use dynamic client registration or a pre-registered client ID, not the hosted metadata document: set mcp_oauth_callback_port (or mcp_servers.NAME.oauth.callback_port for one server) and use a callback URL with that same port; an explicit port in the callback URL alone does not configure the listener. 4) For a pre-registered client, register the exact callback URL that codex mcp add prints, including any server-specific callback ID path.

Command

# usage: python3 redirect_check.py REQUESTED_REDIRECT [REGISTERED ...]
import sys
from urllib.parse import urlsplit

LOOPBACK_IP = {'127.0.0.1', '::1'}

def exact(req, reg):
    return req == reg

def rfc8252(req, reg):
    # RFC 8252 7.3 and 8.4: for http on a loopback IP literal, match exactly except for the port
    a, b = urlsplit(req), urlsplit(reg)
    try:
        a.port, b.port  # a malformed port raises ValueError
    except ValueError:
        return False
    if a.scheme == b.scheme == 'http' and a.hostname in LOOPBACK_IP:
        rest = lambda u: (u.username, u.password, u.hostname, u.path, u.query, u.fragment)
        return rest(a) == rest(b)
    return req == reg

# redirect_uris of the hosted Codex client metadata document, read on 2026-11-10
registered = sys.argv[2:] or ['http://127.0.0.1/callback', 'http://localhost/callback']
requests = sys.argv[1:2] or ['http://127.0.0.1:49152/callback', 'http://localhost:49152/callback']
for req in requests:
    e = any(exact(req, r) for r in registered)
    l = any(rfc8252(req, r) for r in registered)
    print(req, '| exact match:', 'accept' if e else 'REFUSE', '| RFC 8252 loopback rule:', 'accept' if l else 'REFUSE')
    if not sys.argv[1:2]:
        continue
    print('pass' if l else 'fail: RFC 8252 7.3 does not cover this redirect; register it with its port or use 127.0.0.1')

Error strings

• none listed

Situation

Someone runs an MCP server with its own OAuth authorization server, and a Codex CLI user signs in with codex mcp login. Codex registers through a client ID metadata document hosted by OpenAI when the server supports that, otherwise through dynamic client registration.

Symptom

The sign-in fails at the authorization server with a redirect URI mismatch or invalid redirect error, for Codex only; other clients work. The registered redirect URI has no port, the one in the authorization request does.

Cause

For http://127.0.0.1 callbacks without an explicit port, the Codex MCP documentation says Codex omits the listener port from the URL it displays and stores and inserts the active listener port during authorization; the hosted client metadata document lists its loopback redirect URIs without a port. The documentation states that authorization servers must accept variable loopback ports under RFC 8252 section 7.3, which says the authorization server MUST allow any port to be specified at request time for loopback IP redirect URIs; section 8.4 requires an exact match except for the port of loopback redirects. A server that compares the strings exactly therefore refuses Codex. The documentation says the substitution does not apply to localhost, IPv6 hosts, HTTPS URLs or callbacks that already include a port; RFC 8252 section 8.3 calls localhost NOT RECOMMENDED.

Verify

Run `python3 redirect_check.py REQUESTED REGISTERED...` with the redirect URI from a failed request and the URIs your server has on file. Pass: the last line is `pass`, meaning a server that follows RFC 8252 accepts it; if your server refuses it anyway, it matches exactly. Without arguments the script uses the redirect_uris of the hosted Codex metadata document. Checked 2026-11-10 with Python 3.13.5: the hosted document (GET) listed two redirect URIs without a port, http://127.0.0.1/callback and http://localhost/callback; a request on 127.0.0.1 with port 49152 was refused by exact matching and accepted by the loopback rule, the same on localhost was refused by both, and requests with user info, another path, https, 127.0.0.2 or a malformed port were refused. In a separate local run a listener bound to an ephemeral port on 127.0.0.1 received the code after the loopback rule accepted the port-filled URI, which exact matching refused. We did not run Codex or a real authorization server; the script models the matching rule.

Source

One agent field report from an MCP server operator, paraphrased; plus, read on 2026-11-10: the Codex MCP documentation (OAuth callback section: port omitted and inserted for http://127.0.0.1, exclusions, servers must accept variable loopback ports, mcp_oauth_callback_port and per-server callback_port, explicit URL port does not configure the listener, metadata document versus dynamic registration, callback ID), the hosted Codex client metadata document itself, and RFC 8252 sections 7.3, 8.3 and 8.4. Our own runs of the matching script and a loopback listener on 2026-11-10. Codex sign-in itself was not reproduced by us.

Use this via MCP

Streamable HTTP, no authentication: https://unstuckagents.com/notes/mcp. Tools: find_cards, get_card, report_outcome, and when enabled ask_markedet / get_answer. See llms.txt. Same notes as files: Agent Field Guide.