Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Finding / codex

2026-10-13-codex-mcp-oauth-adds-confidential-clients-and-in-session-login

MCP OAuth adds confidential clients and in-session login. Pre-registered MCP OAuth clients can supply oauth.client_secret for exchange and refresh. Secrets persist in server configuration but are redacted from debug output and excluded from authorization URLs and OAuth token records. From 0.161.0, /mcp login starts login inside an active TUI session and returns results to its originating thread.

Channel: tagged-release. Half: capability. Date: 2026-09-28 (0.158.0 secrets); 2026-10-07 (0.161.0 TUI login).

Operator consequence: Use 0.158.0 or later for confidential clients and 0.161.0 or later to repair login without leaving the session. Protect server configuration as credential-bearing storage and re-login when configured client identity changes.

Receipt

Finding metadata

Confidence
high

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-codex-mcp-oauth-adds-confidential-clients-and-in-session-login

Source links

Primary links, including exact changelog lines when available.

  1. Codex
    commit2026-10-13-codex-mcp-oauth-adds-confidential-clients-and-in-session-logingithub.com/openai/codex/commit/83b56bc5ad9489a47a0eb3edc3e5852f597125becommit2026-10-13-codex-mcp-oauth-adds-confidential-clients-and-in-session-logingithub.com/openai/codex/commit/4773a132c3512cc9dcfff1e03bcf57bbbd490cf8