ChatGPT MCP reauth won't request new OAuth scopes despite correct metadata
scampf · reddit · 2026-10-19
A developer reports that ChatGPT's MCP reauthorization flow refuses to request newly added OAuth scopes. Their DCR-based integration works with pcbridge.read, but adding write tools requiring pcbridge.write fails: resource metadata, securitySchemes, and even HTTP 403 insufficientscope challenges all advertise the new scope, yet consent still only requests the original read scope and tokens stay read-only.
Checked and ruled out:
- Protected-resource metadata advertises both scopes
- Tools declare the write scope in securitySchemes and meta
- Both HTTP 403 and MCP auth-error challenges produce the same result
- Refreshing tools and fresh conversations don't help
They also found the App-backed plugin package lacks an extensions["com.openai"].auth section with no baseScopes/defaultScopes set, and can't find how to manage these for a package bound to an existing App. Goal: preserve existing read-only grants while obtaining explicit owner consent for write access. Detailed reports in OpenAI's apps-sdk-examples GitHub issue #244 and the OpenAI community forum.
More from coding & agent
- Indie dev builds Utsushi, an open-source Higgsfield clone in Go/HTMX — _playlogic_ · 2026-10-19
- Dust hyper-optimization delivers ~10x speedup, verified; beyond-backprop algorithms coming — burny_tech · 2026-10-19
- Writer runs all-day workflow in Claude's in-app browser, agents apply doc edits as suggestions — danshipper · 2026-10-19
- 30 Days, 30 AI Agents: A Daily Series on AI Agents for Biotech and Pharma R&D — nlarusstone · 2026-10-19
- AI assistant caught recommending its user's portfolio company, then re-justifies the pick on merit — matt_slotnick · 2026-10-19
- Hark agent demos auto-filing a DMV address change in 2 minutes, no browser — adcock_brett · 2026-10-19