🤖 fix: support HTTP-transport MCP servers in OAuth probe (Figma)#2610
🤖 fix: support HTTP-transport MCP servers in OAuth probe (Figma)#2610
Conversation
…th challenge
- probeWwwAuthenticateHeader: try POST after GET so servers that return
405 on GET (e.g. Figma's HTTP-transport endpoint) still surface the
WWW-Authenticate header.
- extractBearerOauthChallenge: return {} instead of null when the header
is missing or unparseable on 401/403. This lets the UI show the OAuth
banner; the login flow discovers endpoints via .well-known independently.
- Tests: POST-fallback extraction, minimal challenge on bare 401.
probeServerForBearerChallenge now tries GET first, then POST. This handles HTTP-transport MCP servers (like Figma) that return 405 on GET but 401+WWW-Authenticate on POST. New probeWellKnownResourceMetadata helper directly probes /.well-known/oauth-protected-resource. Both startDesktopFlow and startServerFlow use it as a fallback when the bearer challenge probe doesn't extract a resourceMetadataUrl, letting the SDK discover the correct auth server via RFC 9728.
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 02898ed0de
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Addressed both comments:
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: be7e330439
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Fixed P2: sub-path well-known URL now built from |
|
Codex Review: Didn't find any major issues. You're on a roll. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Paired back the PR to a minimal UX-only change: a targeted, user-friendly error message for Figma’s remote MCP 403 “Forbidden” registration failure. |
|
Codex Review: Didn't find any major issues. Bravo. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Follow-up: ensure the Figma 403 guidance is also shown in the remote OAuth status panel (Login error path). |
|
Codex Review: Didn't find any major issues. 🎉 ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Summary
Improve the OAuth login UX for Figma’s remote MCP server by replacing the confusing 403 “Invalid OAuth error response” message with actionable guidance.
Background
Figma’s remote MCP requires an approved client. When an unapproved client attempts OAuth registration, the auth server returns a plain‑text 403 Forbidden, which the SDK surfaces as:
This is technically correct but unhelpful. Users need clear direction about the approval requirement and the desktop MCP fallback.
Implementation
MCPSettingsSectionthat detects the Figma remote MCP URL + the 403 Forbidden error signature and replaces it with a user‑friendly message.Validation
make static-checkRisks
Generated with
mux• Model:openai:gpt-5.2-codex• Thinking:xhigh• Cost:$13.64