claude-code - 💡(How to fix) Fix [BUG] MCP OAuth flow fails: listener port doesn't match redirectUri, causing ERR_CONNECTION_REFUSED and "invalid code verifier" [1 participants]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

Describe the bug

When using a remote MCP server with OAuth configured in .mcp.json, Claude Code sends a fixed redirect_uri in the authorization request but binds its callback listener on a random ephemeral port. This causes two failures:

1. The browser is redirected to the registered redirect_uri (e.g. http://localhost:8205/callback) but nothing is listening there → ERR_CONNECTION_REFUSED
2. If the callback is manually forwarded to the actual listener port, the token exchange fails with "invalid code verifier" because Claude Code sends the ephemeral port as redirect_uri in the token exchange request, which doesn't match what was sent in the authorization request

To reproduce

1. Configure a remote MCP server with OAuth in .mcp.json: { "type": "http", "url": "https://api.salesforce.com/platform/mcp/v1/analytics/tableau-next", "oauth": { "clientId": "<client_id>", "redirectUri": "http://localhost:8205/callback" } }
2. Register http://localhost:8205/callback as the callback URL in the OAuth provider (Salesforce Connected App)
3. Trigger MCP auth in Claude Code
4. Observe the authorization URL contains redirect_uri=http%3A%2F%2Flocalhost%3A8205%2Fcallback
5. Complete login — browser is redirected to http://localhost:8205/callback but gets ERR_CONNECTION_REFUSED
6. Running netstat confirms nothing is listening on 8205 during the flow

Expected behavior

Claude Code should bind its callback listener on the port specified in redirectUri, so the browser redirect lands on an active listener.

Actual behavior

Claude Code binds the listener on a random ephemeral port (observed: 40236, 40442, 45943 across attempts) while sending the configured redirectUri to the auth server. The two are never consistent.

Workaround

A standalone PKCE script that owns the full flow and writes the token directly to ~/.claude/.credentials.json. Available for both PowerShell (Windows) and bash (Mac/Linux).

Environment

• Claude Code version: Version 2.1.120
• OS: Windows 11 (confirmed), likely affects Mac/Linux equally as the OAuth logic is platform-agnostic
• MCP OAuth provider: Salesforce (login.salesforce.com)

What Should Happen?

Expected behavior

Claude Code should bind its callback listener on the port specified in redirectUri, so the browser redirect lands on an active listener.

Error Messages/Logs

Steps to Reproduce

To reproduce

1. Configure a remote MCP server with OAuth in .mcp.json: { "type": "http", "url": "https://api.salesforce.com/platform/mcp/v1/analytics/tableau-next", "oauth": { "clientId": "<client_id>", "redirectUri": "http://localhost:8205/callback" } }
2. Register http://localhost:8205/callback as the callback URL in the OAuth provider (Salesforce Connected App)
3. Trigger MCP auth in Claude Code
4. Observe the authorization URL contains redirect_uri=http%3A%2F%2Flocalhost%3A8205%2Fcallback
5. Complete login — browser is redirected to http://localhost:8205/callback but gets ERR_CONNECTION_REFUSED
6. Running netstat confirms nothing is listening on 8205 during the flow

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

2.1.120

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

No response