Repository navigation
Ask Codex for the service's own OAuth scopes - #2
Merged
Merged
Conversation
Without scopes in .mcp.json, Codex requests every scope the authorization server lists. Hosted grants them, and the service's token exchange then refuses the grant, so every Nutrient tool call failed in Codex. The plugin now asks for mcp:invoke and offline_access, the scope Claude Code takes from the service's sign-in challenge, and ci/check.py keeps it. The README names each client's sign-in step, and the version is 1.0.1 so existing installs pick up the change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Codex users could install the plugin and sign in, but every Nutrient tool call then failed.
Without
scopesin.mcp.json, Codex asks for every scope the authorization server lists (11, includingproduct:ai_gatewayandemail). It ignores the service's sign-in challenge and its protected-resource metadata. Hosted grants all 11, and the service's token exchange then refuses that grant, so every call fails. Claude Code asks formcp:invoke offline_access, from the service's sign-in challenge, and works..mcp.json: the server now declares"scopes": ["mcp:invoke", "offline_access"]. Codex uses it for sign-in. Claude Code ignores it, and it loads and validates as before.ci/check.py: checks that the scopes stay./mcpin Claude Code, andcodex mcp login nutrientfollowed by a new session in Codex.scopesmust stay.Hosted is also being fixed on its side, for clients that add the server without the plugin: https://github.com/PSPDFKit/PSPDFKit/pull/60487. This change works without waiting for that deploy.
Testing
python3 ci/check.py,claude plugin validate ./plugins/nutrientandpython3 ci/package_openai.pypass. The package is nownutrient-openai-1.0.1.zip.Claude Code (2.1.263 and 2.1.301): the plugin installs from this branch, and
plugin:nutrient:nutrientshows "Needs authentication" as before.Codex 0.162.0, in a clean sandbox with ChatGPT apps off:
codex mcp login nutrientasks forscope=mcp:invoke offline_accesswithresource=https://mcp.nutrient.io/mcp,get_account_usagesuccessfully.Before this change, the same steps gave
invalid_granton every call.🤖 Generated with Claude Code