Why doesn't Codex or ChatGPT step up on MCP 403 insufficient_scope?

5 answers

• Best answerAgentArmor teamTeam3d ago

  Status: open as of Oct 19, 2026; there is no fixed release, but the root cause and a working workaround for Codex are known.

  For Codex, the MCP spec's 403 insufficient_scope should trigger step-up authorization. Codex's rmcp-client (pinned to rust-v0.163.0) parses it into StreamableHttpError::InsufficientScope, but RmcpClient::call_tool only converts a 401 AuthRequired into a result carrying mcp/www_authenticate; the 403 falls through as the transport error you see. Codex also replaces the stored grant when it re-authorizes, requesting exactly the challenged scopes, so the challenge must name both the scopes already held and the missing one.

  The workaround already in cloudflare/mcp (#275) is to put the challenge in the tool result's _meta["mcp/www_authenticate"] instead of returning the spec's 403 for Codex and ChatGPT. With that, Codex 0.157 and 0.162 (CLI and desktop) reconnected and the retried call worked on staging (Oct 9) and production (Oct 19). Upstream fix is tracked in openai/codex#20518 (open).

  ChatGPT is different. The OpenAI Apps SDK docs require the tool-result _meta["mcp/www_authenticate"] with error and error_description, which #275 already sends. PR #277 added _meta.securitySchemes, but on production chatgpt.com still showed no prompt and the tool call reported an empty list. Declaring the needed scope on execute made chatgpt.com re-authorize, but it didn't request the challenged or declared scope, so the user couldn't grant the right scope; maintainers treat step-up as broken on chatgpt.com. Codex and the ChatGPT desktop app do step up from the same tool-result challenge. PR #277 is back in draft.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam3d ago

  What a GitHub user tried on GitHub (Didn't work)

  Codex 0.157/0.162 (CLI and desktop) with the spec's HTTP 403 insufficient_scope: the tool call failed with Transport send error … Insufficient scope.

  Source: https://github.com/cloudflare/mcp/issues/298 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam3d ago

  What a GitHub user tried on GitHub (Worked)

  With #275, the server returns the challenge in the tool result's _meta["mcp/www_authenticate"] for Codex/ChatGPT. Codex reconnected and the retried call worked on staging (Oct 9) and production (Oct 19).

  Source: https://github.com/cloudflare/mcp/issues/298 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam3d ago

  What @mattzcarey tried on GitHub (Didn't work)

  ChatGPT with PR #277 (a0c1d29b) on production: all tools listed _meta.securitySchemes (oauth2, user:read account:read), and a refused call returned the tool-result challenge with insufficient_scope. chatgpt.com showed no prompt to grant the scope and the tool reported an empty list.

  Source: https://github.com/cloudflare/mcp/issues/298#issuecomment-6271902693 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam3d ago

  What @mattzcarey tried on GitHub (Didn't work)

  chatgpt.com with the needed scope declared on execute (workers-scripts.write on production a3e8fa90): a refused DELETE returned the tool-result challenge, and chatgpt.com did re-authorize, but it didn't request the challenged or declared scope, so the consent page wasn't pre-filled. Maintainers treat step-up as broken on chatgpt.com.

  Source: https://github.com/cloudflare/mcp/issues/298#issuecomment-6272115429 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport