Remote MCP Server OAuth fails in latest VSCode Insiders

[omgitsads]

Describe the bug

Since microsoft/vscode#259089 was introduced the Remote MCP OAuth Protected Resource implementation is failing due to a mismatch in our documented URL, https://api.githubcopilot.com/mcp/ and the resource defined in the metadata at https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp. These should match exactly with the URL used for the MCP server.

We (GitHub) are aware of this issue and working on a fix but for the moment there are some workarounds:

• Use https://api.githubcopilot.com/mcp instead of https://api.githubcopilot.com/mcp/.
• For MCP servers with limited toolsets or read only toolsets use the X-MCP-Toolsets and X-MCP-Readonly headers instead of the URL endpoints.
  • i.e. Instead of https://api.githubcopilot/mcp/x/issues/readonly, set the X-MCP-Toolsets: issues and X-MCP-Readonly: true

  {
    "servers": {
    	"github": {
    		"type": "http",
    		"url": "https://api.githubcopilot.com/mcp",
    		"headers": {
    			"X-MCP-Toolsets": "issues",
    			"X-MCP-Readonly": "true"
    		}
    	}
    }
  }

x-ref: microsoft/vscode#259251

[Sayvai]

✅ The solution outlined in the main issue description resolved my issue. Here's my working JSON configuration snippet, enforcing read-only mode without toolset limitations:

{
  "servers": {
  	"github": {
  		"type": "http",
  		"url": "https://api.githubcopilot.com/mcp",
  		"headers": {
  			"X-MCP-Readonly": "true"
  		}
  	}
  }
}

---

⚠️ Here's a screenshot of the previous error I had encountered for reference:

{
  "servers": {
  	"github": {
  		"type": "http",
		"url": "https://api.githubcopilot.com/mcp/",
		"mode": "read-only"
  	}
  }
}

As seen from the screenshot + JSON config snippet, this was my previous problematic JSON configuration, which was sourced from a very recently published official GitHub Blog article; A practical guide on how to use the GitHub MCP server, which I think 👉 needs updating 👈 as soon as possible to reflect the latest correct JSON configuration.

[omgitsads]

Thanks @Sayvai ❤️ I've flagged these issues with our blog team.

[Sayvai]

@omgitsads - Thanks for that ❤️

It seems like the blogger updated the article, however, I still notice the forward slash at the end of the url value, which may still cause oAuth issues for other users, like you've outline in the main Issue description above.

So you may like to nudge the team again to make the following further adjustment to the article code snippet:

{
  "servers": {
    "github": {
      "type": "http",
-     "url": "https://api.githubcopilot.com/mcp/",
+     "url": "https://api.githubcopilot.com/mcp",
      "headers": {
        "X-MCP-Readonly": "true"
      }
    }
  }
}

[omgitsads]

@Sayvai This is the correct URL, without the / is a workaround as this only impacts Insiders for now, not VSCode stable. I will be shipping a fix for this today.

[omgitsads]

This should be fixed now.

[Sayvai]

Thanks @omgitsads!

✅ I was able to start the server with the forward slash (/) appended to the end of the URL: 👇

---

PS: I did observe an error in the terminal output (see screenshot above), but that's merely to do with failing to register the Error log level, which may be worth looking into as a separate issue, maybe:

[error] Failed to set MCP server log level: Error: MPC -32603: session does not support setting logging level

[omgitsads]

Thanks for validating @Sayvai. I'll close this out.

[julio199p]

Describe el error

Desde la introducción de microsoft/vscode#259089, la implementación del recurso protegido OAuth de MCP remoto falla debido a una discrepancia entre la URL documentada https://api.githubcopilot.com/mcp/y la resourcedefinida en los metadatos en https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp . Deberían coincidir exactamente con la URL utilizada para el servidor MCP.

Nosotros (GitHub) estamos al tanto de este problema y estamos trabajando para solucionarlo, pero por el momento hay algunas soluciones alternativas:

• Utilizar https://api.githubcopilot.com/mcpen lugar de https://api.githubcopilot.com/mcp/.

• Para servidores MCP con conjuntos de herramientas limitados o conjuntos de herramientas de solo lectura, utilice los encabezados X-MCP-Toolsetsy X-MCP-Readonlyen lugar de los puntos finales de URL.

  • es En lugar de https://api.githubcopilot/mcp/x/issues/readonly, establezca X-MCP-Toolsets: issuesyX-MCP-Readonly: true

  {
  "servers": {
  "github": {
  "type": "http",
  "url": "https://api.githubcopilot.com/mcp",
  "headers": {
  "X-MCP-Toolsets": "issues",
  "X-MCP-Readonly": "true"
  }
  }
  }
  }

referencia externa: microsoft/vscode#259251

[julio199p]

//
// Default debug settings (fresh project), /RTC1 is in:
// /JMC /permissive- /ifcOutput "MSVCTest.b190464a\x64\Debug" /GS /W3 /Zc:wchar_t /ZI /Gm- /Od /sdl /Fd"MSVCTest.b190464a\x64\Debug\vc143.pdb" /Zc:inline /fp:precise /D "_DEBUG" /D "_CONSOLE" /D "_UNICODE" /D "UNICODE" /errorReport:prompt /WX- /Zc:forScope /RTC1 /Gd /MDd /FC /Fa"MSVCTest.b190464a\x64\Debug" /EHsc /nologo /Fo"MSVCTest.b190464a\x64\Debug" /Fp"MSVCTest.b190464a\x64\Debug\MSVCTestUninitializedBool.pch" /diagnostics: column
//

#include

struct test
{
bool bTest;

test()
{
bTest = true;
}
test(int a)
{
if (bTest)
std::cout << "bTest underlying value is: 0x" << std::hex << (int) ((unsigned char) &bTest) << "\n";
//
// output: "bTest underlying value is: 0xcc" (uninitialized value marker) but no break/assertion failure or anything during debug run - all "clean"
//
}
};

int main()
{
test t(1);
return 0;
}/