Broken OAuth flow with Codex CLI

[mhemmings]

The OAuth flow when using the Github remote MCP with Codex CLI gives a Github 404 page (Also seen in #1177 (comment), but opening as separate issue)

To replicate, add the following to your Codex config.toml

[features]
rmcp_client = true

[mcp_servers.github]
url = "https://api.githubcopilot.com/mcp/"

and run

codex mcp login github

The OAuth flow is started and a 404 page is opened in the browser.

Note: When launching Codex CLI the following error is shown:

GitHub MCP does not support OAuth. Log in by adding a personal access
token (https://github.com/settings/personal-access-tokens) to your
environment and config.toml:
[mcp_servers.github]
bearer_token_env_var = CODEX_GITHUB_PERSONAL_ACCESS_TOKEN

Adding this config changes the error message to

The github MCP server is not logged in. Run `codex mcp login github`.

Affected version

v0.53.0

[mhemmings]

After further investigation, I think this is by design and Github MCP doesn't currently support OAuth?
My issue was bearer_token_env_var was set incorrectly, and fixing this has given me access to Github MCP.

The 404 issue on codex mcp login github persists, but I think that's expected.

[kpmarino]

@mhemmings could you explain the bearer_token_env_var issue you had. I'm not getting access though i do get the
The github MCP server is not logged in. Run codex mcp login github.

thx

[mhemmings]

If you're seeing that message, it's likely something isn't setup right such as the environment variable you're using isn't set.

In ~/.codex/config.toml, your setup should look something like

[mcp_servers.github]
url = "https://api.githubcopilot.com/mcp/"
bearer_token_env_var = "GH_MCP_TOKEN"

The GH_MCP_TOKEN environment variable needs setting, for example with export GH_MCP_TOKEN=github_pat_xxxxxxxxxxxxxx.

It's far from ideal having to use PAT especially set in the environment. Hopefully Github will bring OAuth login soon.

[jibaxZZZ]

Hello everyone thanks to your setup I could setup the GitHub MCP Server on codex but when I ask to list all my repos he can list only my public repos but he had no access to the privates even with the PAT ? any ideas ?