Codex MCP OAuth fails on both /mcp URL variants; CLI reports Premium Archive as Free

problem
1

I am a Premium Archive subscriber, but cannot authenticate NewsBlur MCP with Codex on macOS.

With this Codex configuration:

[mcp_servers.newsblur]
url = "https://newsblur.com/mcp"

I get:

Error: Metadata error: Protected resource metadata resource mismatch:
reference 'https://newsblur.com/mcp',
permitted 'https://newsblur.com/mcp/'

With the trailing slash:

[mcp_servers.newsblur]
url = "https://newsblur.com/mcp/"

I get:

Error: Authorization server issuer mismatch:
expected https://newsblur.com/mcp,
received https://newsblur.com/mcp/

I logged out and retried, with the same results.

It looks as if the protected-resource metadata and OAuth authorization-server metadata use inconsistent canonical URLs (/mcp vs. /mcp/). Codex validates these URLs strictly, so neither documented URL variant works.

There may also be a related CLI issue. newsblur auth status reports Tier: Free, although this is the correct account and it has an active Premium Archive subscription. The CLI can retrieve my folder list, so authentication itself succeeded.

Could you check both the MCP OAuth metadata URL consistency and the subscription tier returned to the CLI/OAuth client?

2

Good catch, and thanks for the precise report. The two metadata documents disagreed on the canonical URL: the discovery metadata at the origin root advertised https://newsblur.com/mcp/ with a trailing slash while the MCP server itself uses https://newsblur.com/mcp without it. Codex validates those strictly, so both config variants failed. I’ve made everything consistent on the no slash form, which passes Codex’s validation for both URL styles. It will be live shortly, and then either url variant in your config.toml will work.

On the CLI: your account is correctly Premium Archive on the server and the account info endpoint returns the right tier. The bug was that when the CLI’s account info request fails for any reason, it silently showed Tier: Free instead of admitting it couldn’t fetch your info. The next CLI release shows Unknown plus the error instead. If you run newsblur auth status again it should say Archive.