Dated research · 10 October 2026 · documentary location correction
Provided OAuth client: locate the ID, protect the secret, verify saved state
The documented registered-client location is now established. Configure the client ID with the named MCP server; put a required application secret only into connection setup. An uploaded file is not proof that saved credentials were replaced.
Use the four-step decision on Submit → The owner ordering, broader redacted clarification packet and stop advice are our synthesis, not an official required form, universal remedy or tested repair. No full configuration sample, credential or observed portal control is supplied.
What this narrow inspection earns
- The exact portable server location
- Root
mcp.json→ the named server’smcpServers.<server>.extensions["com.openai"].auth.client, withmode: "provided"and case-sensitiveclientId. This is not plugin-level OpenAI metadata, a guessed top-level key, registered-app mapping or local Codex/TOML setting. The actual reported upload format is unknown. Packaging · Path rules / Configure MCP authentication / Registered client. - Reference optionality is not omission behavior
- The reference makes client optional, mode required when present and clientId required for provided. tokenEndpointAuthMethod is optional in that reference; Submission instructs declaring the selected method. Match the existing provider registration and supported contract, rather than infer a default or switch modes to avoid a field. No omitted-method account behavior or package-schema validation was established. Packaging · OAuth configuration reference, Submission · Configure authentication.
- A required secret belongs in Connect, not the ZIP
- Documented MCPs → server → Connect → OAuth Client Secret; the field is conditional for a provided client unless the method is none. clientSecret is rejected in mcp.json. Application credentials differ from user password/access token/reviewer login. Legitimate secretless none must fit the real public-client/provider contract. private_key_jwt declaration supplies no signing-key setup; it is not a working submission recipe. Submission · Configure authentication / Authentication limitations, Packaging · Registered client.
- Source, upload and saved registration are separate states
- Advanced panel settings are read/displayed from mcp.json, not edited there. The documented source edit → Upload new version → saved MCPs-settings inspection before connecting does not prove credential replacement; existing registration can lock changes. Whether the reader’s connection is locked, and how it would be unlocked, remain unknown. Our stop-and-clarify advice avoids arbitrary resets or repeated uploads. Submission · Configure authentication for submission.
- Method declarations are not public eligibility or working authorization
- Direct remote-MCP declarations differ from excluded registered apps/.app.json mappings; no new narrow contradiction was established in that pair. API-key schema acceptance cannot complete portal setup, and nonempty server headers are rejected—no bearer-input/header bypass. Configuration, connection, scan, user/reviewer access, useful output, review, approval and chosen Publish differ. Protected services must not be mislabeled no-auth. Submission · Authentication limitations / Public ZIP scope / Connect and scan.
Primary-source basis and comparison
- Upload and submit your plugin: Connect and scan; Configure authentication for submission; Authentication limitations; supporting reviewer separation and support plugin-ID instruction; Automatically provide submission/review information and Complete metadata examples.
- Package your plugin: Path rules; Bundled MCP servers; Configure MCP authentication; Use a registered OAuth client; automatic registration; OAuth configuration reference; API-key/header distinction only.
- Authentication: selected provider/client/user prerequisites; Publish OAuth metadata; Protect callbacks / Redirect URL; OAuth flow; retained-client registration and Client identification. Fuller callback/triage evidence retains 9 October.
Three undated primary pages independently searched/opened; relevant sections read and Submission’s linked MCP reference followed. Planner leads/search snippets were not authority. Exact namespace, conditional secret entry and display/source/saved-state distinctions are newly inspected / scope-sensitive, not newly introduced behavior. Provider and lifecycle boundaries were reconfirmed. Changed with evidence: none. Earlier claim ledgers are not comparable whole-page archives.
The method-reference optionality and Submission declaration instruction are preserved at their different levels; omitted/default behavior is unestablished. No new direct-MCP-versus-registered-app conflict was found. Earlier hook conversion/submission tension remains 6 October; annotation, checkout and endpoint conflicts retain their own dates—no precedence or exception inferred.
Retained checks and remaining unknowns
The supporting 9 October disclosures retain exact connection-callback/issuer checks, provider registration prerequisites, conditional existing-DCR retained-client advice and separate user/reviewer/reconnect/rescan/Refresh gates. They are not a newly dated OAuth tutorial or the reported blocker’s diagnosis. Missing actual callback/management output stays UNKNOWN; no copied URI or auth downgrade.
UNKNOWN: original uploaded format/mode/client/secret validity, account/control availability, actual provider methods/scopes/endpoints/callback/issuer/allowlist behavior, saved connection/registration lock, cause, authorized correction and result, account eligibility and intended-user/reviewer useful access. NOT RUN: provider/portal login/registration, upload/config mutation, connect/reconnect/domain verification, endpoint/API/Inspector/host/tool operations, scan/use/retest, submission/review/approval/Publish, support contact, guide-use observation, analytics or media. No lawful account/provider access, consenting participant or footage supplied.
Genuine simpler alternative: if protected customer data/actions are unnecessary, an ordinary prompt/skill or existing legitimate website/integration may suffice. Untested alternatives, not drop-ins or authentication/public-review bypasses; no acquisition/approval promise.
Only exact client-location/connection-state guidance earns 10 October. Supporting OAuth/callback triage stays 9, continuity 8, CLI 7, public ZIP/conversion 6, host/dependency 5, annotations 4, commercial boundary 3, endpoint/recorder 2, checker 1 October; other checks stay 29 September. All ten prior reports, 28 assets, original Meeting Evidence 0.1.0 source/downloads, existing widget/helper and separate 33 checker / 49 recorder histories remain byte-preserved/unrerun. Ten actual-host cases remain NOT RUN. Analytics disconnected means unknown use, not zero. No queue side study, new kit/tool/config/download/media or broad guide refresh. Research/editorial draft preparation is separate from browser validation and Runtime acceptance/delivery/publication.