diff --git a/codex-rs/config/src/mcp_types.rs b/codex-rs/config/src/mcp_types.rs
index a276cd7070a4..d642d9fc5722 100644
--- a/codex-rs/config/src/mcp_types.rs
+++ b/codex-rs/config/src/mcp_types.rs
@@ -176,7 +176,11 @@ pub struct McpServerConfig {
     pub tools: HashMap<String, McpServerToolConfig>,
 }
 
-/// Raw MCP config shape used for deserialization and JSON Schema generation.
+/// Raw MCP config shape used for deserialization and supported-field JSON
+/// Schema generation.
+///
+/// Fields that are accepted only to produce targeted validation errors should
+/// be skipped in the generated schema.
 ///
 /// Keep `TryFrom<RawMcpServerConfig> for McpServerConfig` exhaustively
 /// destructuring this struct so new TOML fields cannot be added here without
@@ -200,6 +204,7 @@ pub struct RawMcpServerConfig {
 
     // streamable_http
     pub url: Option<String>,
+    #[schemars(skip)]
     pub bearer_token: Option<String>,
     pub bearer_token_env_var: Option<String>,
 
diff --git a/codex-rs/core/config.schema.json b/codex-rs/core/config.schema.json
index 1223b45a6212..3211010c0514 100644
--- a/codex-rs/core/config.schema.json
+++ b/codex-rs/core/config.schema.json
@@ -1709,7 +1709,7 @@
     },
     "RawMcpServerConfig": {
       "additionalProperties": false,
-      "description": "Raw MCP config shape used for deserialization and JSON Schema generation.\n\nKeep `TryFrom<RawMcpServerConfig> for McpServerConfig` exhaustively destructuring this struct so new TOML fields cannot be added here without updating the validation/mapping logic that produces [`McpServerConfig`].",
+      "description": "Raw MCP config shape used for deserialization and supported-field JSON Schema generation.\n\nFields that are accepted only to produce targeted validation errors should be skipped in the generated schema.\n\nKeep `TryFrom<RawMcpServerConfig> for McpServerConfig` exhaustively destructuring this struct so new TOML fields cannot be added here without updating the validation/mapping logic that produces [`McpServerConfig`].",
       "properties": {
         "args": {
           "default": null,
@@ -1718,9 +1718,6 @@
           },
           "type": "array"
         },
-        "bearer_token": {
-          "type": "string"
-        },
         "bearer_token_env_var": {
           "type": "string"
         },
diff --git a/codex-rs/core/src/config/schema_tests.rs b/codex-rs/core/src/config/schema_tests.rs
index 31fabd64bd2f..dd67ead89867 100644
--- a/codex-rs/core/src/config/schema_tests.rs
+++ b/codex-rs/core/src/config/schema_tests.rs
@@ -53,3 +53,23 @@ Run `just write-config-schema` to overwrite with your changes.\n\n{diff}"
         "fixture should match exactly with generated schema"
     );
 }
+
+#[test]
+fn config_schema_hides_unsupported_inline_mcp_bearer_token() {
+    let schema_json = config_schema_json().expect("serialize config schema");
+    let schema_value: serde_json::Value =
+        serde_json::from_slice(&schema_json).expect("decode schema json");
+    let properties = schema_value
+        .pointer("/definitions/RawMcpServerConfig/properties")
+        .expect("RawMcpServerConfig properties should exist")
+        .as_object()
+        .expect("RawMcpServerConfig properties should be an object");
+
+    assert_eq!(
+        (
+            properties.contains_key("bearer_token"),
+            properties.contains_key("bearer_token_env_var"),
+        ),
+        (false, true),
+    );
+}