Feature Request: Use an Identifiable User-Agent for Custom MCP Server Validation

ChatGPT Feature requests
, , ,
1

Feature Request: Use an Identifiable User-Agent When Validating Custom MCP Servers

When adding a custom MCP server through ChatGPT Settings, I attempted to connect the following MCP endpoint:

https://ifoundagent.com/wp-json/ifound-mcp/v1/mcp

After submitting the endpoint, ChatGPT displays the following error:

MCP server {url} does not implement OAuth

However, the MCP host’s server logs indicate that the request used during validation was sent with the User-Agent:

curl/8.5.0

This appears to be creating a compatibility issue with the host’s WAF. The WAF treats this generic/incomplete User-Agent as an automated or potentially suspicious request and blocks it. As a result, ChatGPT may not actually receive the MCP server’s intended OAuth or capability response, and instead reports that the MCP server “does not implement OAuth.”

The attached HAR confirms the browser-side flow: after submitting the custom MCP URL, ChatGPT makes a request to its backend endpoint:

POST https://chatgpt.com/backend-api/aip/connectors/mcp/oauth_config

with the MCP URL in the request body. The backend returns:

MCP server https://ifoundagent.com/wp-json/ifound-mcp/v1/mcp does not implement OAuth

The HAR does not capture the subsequent server-to-server request from ChatGPT/OpenAI infrastructure to the MCP endpoint, but the MCP host observed that request arriving with User-Agent: curl/8.5.0.

Requested improvement

Please have ChatGPT/OpenAI infrastructure identify itself more clearly when making MCP discovery, validation, OAuth configuration, and related server-to-server requests.

For example, instead of:

curl/8.5.0

use a descriptive User-Agent such as:

OpenAI-ChatGPT-MCP-Client/1.0

Optionally, including a support or documentation URL in the User-Agent would make it easier for MCP operators to identify and safely allow these requests.

A clearly identifiable User-Agent would:

  • Reduce false positives from WAFs and bot-protection systems.

  • Make MCP validation more reliable.

  • Help MCP server operators distinguish legitimate OpenAI requests from arbitrary curl traffic.

  • Make troubleshooting substantially easier.

  • Avoid misleading errors such as “does not implement OAuth” when the actual issue may be that the MCP discovery request was blocked before OAuth capabilities could be determined.

It would also be helpful if ChatGPT surfaced a more specific error when MCP discovery fails due to an HTTP error, WAF block, timeout, or other upstream connectivity problem, rather than defaulting to “does not implement OAuth.”

This would improve interoperability with MCP servers hosted behind common WAF and security infrastructure.

2

I think there may be a simpler cause worth testing first. When creating a custom MCP connector in ChatGPT, Authentication defaults to OAuth. If your MCP server does not implement OAuth, change Authentication to “No authentication” before creating the connector. Otherwise ChatGPT appears to call its OAuth configuration flow and does not implement OAuth would be the expected error. If the MCP scan still fails with authentication disabled, then the WAF/User-Agent issue would be worth investigating separately.

3

Great advise Rafael!

I think my initial report was lacking so I appreciate you bringing this to my attention but yes I’ve confirmed the endpoint achieves proper oauth support by testing:

  • OAuth authorization-code flow
  • PKCE (S256)
  • Dynamic client registration
  • User login and consent
  • Access and refresh token issuance
  • Authenticated MCP tool access

I’ve confirmed this by connecting the MCP via oauth with claude code, codex, and claude.ai locally and on a separate server with a less-sensitve WAF.

In response to this highlight, I took another attempt at my implementation with this server and used codex for mcp with specific chat-based instruction to use a better UA and with this change it did pass the WAF initially by using this UA:

OpenAI-Codex-MCP-Compatibility-Check/1.0 (+https://openai.com; auth-discovery)

I personally see this as validation that this request/change would be a meaningful albeit small update that will help others and the product.

Please note that I’m working with this host on resolving my specific issue independently of this request.

4

Thanks for the detailed report! We’ll pass along the request for clearer MCP client identification and discovery errors. The OAuth setup reference is here: https://developers.openai.com/plugins/build/auth. We don’t have a confirmed fix or timeline for this case yet.