Hello Vercel MCP team,
The Vercel support AI directed this Beta MCP diagnostic report to the community and declined a private support case. Could engineering investigate the OAuth subject/effective team-grant path?
Environment:
- macOS, Codex desktop; codex-cli 0.162.0-alpha.17.2
- Official endpoint https://mcp.vercel.com, URL-only configuration without custom authorization headers.
- OAuth completed successfully; Codex restarted; codex mcp list reports OAuth.
- The correct browser account has the matching MCP connection, with identity, team-read and authorized-project permissions displayed. The effective team mapping is not visible.
Observed 15 October 2026 around 04:54–05:00 UTC:
- Tool discovery/documentation search works.
- get_auth_user({}) returns 404 User not found.
- list_teams({limit:20}) returns an empty teams array.
- get_project with exact project ID and explicit teamId returns 403 forbidden (saml=false; ssoEnforced=false).
- Request ID: fra1:sfo1::jwg24-1792040028910-7db6bc53f1e2
- list_projects with the explicit team slug also returns 403.
- Request ID: fra1:sfo1::wkzfp-1792040028868-24c51196f861
- Separately authenticated Vercel CLI 64.0.2 successfully reads the same project with explicit team scope. Browser access works too.
Can you correlate these request IDs with a valid OAuth subject and the effective team grant, and identify whether the failure is client credential forwarding or server-side subject/grant resolution? We would like a targeted repair preserving existing permissions. Displayed consent alone has not established effective API access, and we have not assumed another reconnect will fix it.
No email, account/team/project names or IDs, client IDs, tokens, authorization headers, raw logs, screenshots or environment values are included in this public draft. No access, settings, protections or deployments have been changed as part of the diagnosis.