Kiro CLI fails to connect to Atlassian Rovo MCP: "missing field 'scopes'" during OAuth metadata deserialization

[hahanein]

Before opening, please confirm:

• I have searched for duplicate or closed issues

Operating System

Linux (x86_64)

Kiro Version

1.25.1

Bug Description

Kiro CLI fails to load the Atlassian Rovo MCP server from the MCP registry with a deserialization error. During the OAuth handshake with mcp.atlassian.com, kiro-cli parses a metadata response and fails because a scopes field is missing.

Error from logs:

ERROR chat_cli::cli::chat::tool_manager: 1844: Error loading server atlassian-rovo-mcp: McpError(ErrorData { code: ErrorCode(-32002), message: "missing field `scopes` at line 4 column 1", data: None })

The same MCP server connects and works correctly via Amazon Q Developer in VSCode, confirming the server itself is functional and the issue is specific to kiro-cli's parsing.

Steps to Reproduce

1. Have Atlassian Rovo MCP configured via MCP registry (organization-managed profile with registry URL)
2. Run kiro-cli chat
3. Observe the server fails to load with the missing field 'scopes' error

Expected Behavior

Kiro CLI should treat the scopes field as optional and successfully connect to the Atlassian MCP server, as Amazon Q in VSCode does.

Conversation ID

No response

Additional Context

• Related: MCP servers failing to load after Kiro CLI 1.25.0 update (Feb 4, 2026) #5452 (also Atlassian MCP failures post-1.25.0, but different error messages)
• Related: OAuth: Client not following RFC 9728 discovery flow, constructs incorrect authorization URLs #3911 (OAuth discovery issues, different root cause)
• The MCP registry JSON itself loads fine — the error occurs when kiro-cli attempts the OAuth handshake with mcp.atlassian.com

[github-actions]

🤖 Potential Duplicate Detected

This issue appears to be similar to:

• #5452: MCP servers failing to load after Kiro CLI 1.25.0 update (Feb 4, 2026) (85% similar)
• #3911: OAuth: Client not following RFC 9728 discovery flow, constructs incorrect authorization URLs (85% similar)
• #4717: HTTP-based MCP servers not loading tools into chat sessions (82% similar)

What happens next?

• ⏰ This issue will be automatically closed in 3 days
• 🏷️ If this is not a duplicate, you can prevent automatic closure by adding a comment or reacting with 👎 to this message.
• 💬 Comment on the original issue if you have additional information

Why is this marked as duplicate?
Both report MCP server loading failures after Kiro CLI 1.25.0 update, specifically mentioning Atlassian MCP issues, though with different specific error messages

[github-actions]

Thank you for your feedback! 🙏

The 👎 reaction has been noted. The duplicate label has been removed and this issue has been sent back for maintainer review.

A maintainer will review this issue shortly.

[jcancilla-r7]

Also seeing this issue. Looks like OpenAI's codex started seeing a similar issue that was reported yesterday (Feb 11th): openai/codex#11465.

According to the associated PR (openai/codex#11539), the issue is that modelcontextprotocol/rust-sdk#598 in 0.14 broke some MCP oauth, but it was subsequently fixed in 0.15 (modelcontextprotocol/rust-sdk#641).

[lopezfelipe]

+1

[AnilMaktala]

hey @hahanein and @jcancilla-r7, Thank you for the detailed report and the additional context. Linking this to the upstream rust-sdk fix in v0.15. We've noted this and shared it with the team.

In the meantime, we've released CLI version 1.26.0 which includes several fixes. Could you please update to the latest version and verify if this issue still persists?