I appreciate that you tested this the Strava MCP with Claude so I imagine it works, but they aren’t the only agent out there. I’m getting an immediate HTTP 403 with Copilot CLI, and when having it introspect why, it reports:
Root cause: it’s not failing because your strava-mcp entry is missing or malformed; Copilot is rejecting Strava’s OAuth metadata as invalid.
Your config is a normal remote MCP entry in ~/.copilot/mcp-config.json :
"strava-mcp": {
"type": "http",
"url": "https://mcp.strava.com/mcp"
}But the Copilot log shows the auth flow dies here:
OAuth authentication failed for strava-mcp: MCPOAuthError: Incompatible authorization server: authorization server advertised an issuer that does not match the URL its metadata was discovered from (RFC 8414 §3.3); refusing to connect
What’s happening is:
1. strava-mcp challenges the client with an OAuth protected-resource URL on www.strava.com .
2. That metadata points to https://www.strava.com/mcp-issuer as the authorization server.
3. The authorization-server metadata served from that path reports "issuer":"https://www.strava.com" instead of the discovered issuer URL/path.
4. Copilot CLI rejects that mismatch on purpose, so authentication never completes.Bottom line: this is a server-side OAuth metadata bug/incompatibility in Strava’s MCP endpoint, not a bad local Copilot config. The fix has to be on Strava’s side: their protected-resource / authorization-server metadata needs to advertise a consistent issuer.
It would be great if the issue followed the OAuth spec so any agent—even ones people wrote themselves (seems to be the thing these days)—could use it.