agentic-tools

Summary The official Meta Developer Tools MCP endpoint at cannot currently complete a usable connection from multiple clients listed in Meta's setup documentation. We reproduced two related interoperability failures: 1. Newer MCP OAuth clients reject the authorization-server metadata because the advertised authorization-server URL and the returned issuer do not match. 2. A client version that completes OAuth then fails during the Streamable HTTP/SSE initialization handshake, before tools such as become available. This appears to be an interoperability problem in the hosted MCP/OAuth flow rather than a Meta app permission problem. No tool call can be made, including read-only calls. Endpoint Environment and observed results Codex CLI 0.146.0 on macOS 26.6.2 (Apple Silicon) OAuth consent completes successfully. The connection then fails during the Streamable HTTP/SSE initialization handshake. No MCP tools are exposed, so a read-only check cannot be performed. Codex App bundled runtime 0.149.0-alpha.4.1 OAuth discovery is rejected because the client expects the advertised authorization-server issuer to match the issuer returned by the metadata: Hermes Agent 0.20.5 on a Linux VPS Direct remote-MCP OAuth fails on the same issuer validation. The server is kept disabled; issuer validation was not bypassed and no OAuth token was copied between clients. Documented stdio bridge () The bridge cannot finish Dynamic Client Registration: Steps to reproduce 1. Add a Streamable HTTP MCP server with URL and OAuth authentication, following Meta's documentation for Codex or Claude Code. 2. Start authentication and complete Meta sign-in and consent. 3. Depending on the client version, observe either: an authorization-server issuer mismatch before a usable token is accepted; or successful OAuth followed by a Streamable HTTP/SSE initialization failure. 4. Restart the client and check its MCP tools. 5. Observe that the ten documented tools are unavailable and cannot be called. Expected result The clients documented by Meta should be able to: 1. complete OAuth without relaxing issuer validation; 2. initialize the Streamable HTTP MCP session; 3. list the ten documented tools; and 4. run a read-only request. Requested investigation Please check: whether the OAuth protected-resource and authorization-server metadata should consistently advertise as the authorization-server issuer, or otherwise satisfy strict issuer validation; whether the post-OAuth Streamable HTTP and exchange is compatible with the documented Codex and Claude clients; whether Dynamic Client Registration is intentionally unavailable for the documented bridge and, if so, what supported client-registration method should be used; whether the troubleshooting documentation can list these known beta limitations until the server-side flow is fixed. Related public reports OpenAI Codex: https://github.com/openai/codex/issues/38944 Anthropic Claude Code: https://github.com/anthropics/claude-code/issues/86227 Security and privacy No access tokens, refresh tokens, client secrets, Meta app IDs, business IDs, account email addresses, or other private identifiers are included in this report. We did not disable issuer validation or use an OAuth-rewriting proxy.

Environment: Windows 11 Codex CLI 0.146.0 Codex App 26.727.51351 MCP Inspector 2.0.0 Endpoint: https://mcp.facebook.com/devtools Codex OAuth login completes successfully with: developer_tools_mcp_app_read developer_tools_mcp_app_management However, Codex reports: MCP startup interrupted. The following servers were not initialized: devtools MCP Inspector reports: Issuer mismatch in authorization server metadata (RFC 8414 §3.3): expected "https://mcp.facebook.com/devtools", received "https://www.facebook.com"