Repository navigation
Allow a fixed OAuth callback port for remote MCP servers #5391
Description
Problem
For a remote MCP server with a pre-registered OAuth client (oauthClientId and oauthPublicClient in mcp-config.json), the CLI listens on a random loopback port (listen(0, "127.0.0.1")) and sends redirect_uri=http://127.0.0.1:<random>/. Authorization servers that match redirect URIs exactly, with no wildcards and no dynamic client registration, can't be used.
Looker's managed MCP server is one. Its documentation says it needs a fixed port per client, and lists --callback-port for Claude Code and OAUTH_CALLBACK_PORT for Gemini CLI. With the Copilot CLI, sign-in fails with "redirect_uri" mismatch on most attempts (ports 35731 and 36449 seen).
Request
A per-server setting, for example oauthCallbackPort, in mcp-config.json, or a global environment variable such as COPILOT_OAUTH_CALLBACK_PORT. The CLI would then use http://127.0.0.1:<port>/ and fail clearly if the port is taken.
Version
Copilot CLI 1.0.105, Linux.
Activity
hstaudacher commentedon Nov 10, 2026
A fixed callback port is already supported. Add
"auth": { "redirectPort": 7777 }to the server configuration alongsideoauthClientIdandoauthPublicClient, and registerhttp://127.0.0.1:7777/with the provider. The CLI fails rather than falling back to a random port if the configured port is unavailable. This option shipped in CLI 1.0.49. If it still selects a random port with that configuration, please reopen with the CLI version and a redacted reproduction.