github / github/copilot-cli

MCP OAuth intermittently fails on Windows with socket error 10013

Open
#4,463 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area:authentication area:mcp area:platform-windows
Dominant language
Shell
Stars
11.2k
Forks
1.9k
Avg merge
14h 16m
Merged PRs (30d)
6

Description

Describe the bug

OAuth authentication for a remote HTTP MCP server intermittently fails before the browser authorization flow opens.

OAuth authentication failed: MCPOAuthError: An attempt was made to 
access a socket in a way forbidden by its access permissions. (os error 10013)
Affected version

1.0.79

Steps to reproduce the behavior
  1. Configure an OAuth-enabled remote HTTP MCP server without specifying auth.redirectPort.
  2. Start a new Copilot CLI session.
  3. Run /mcp auth <server-name>.
  4. Authentication may fail while creating the local OAuth callback listener.
Expected behavior

Copilot CLI should select an available callback port. If binding fails, it should retry using another port and report the attempted port if all retries fail.

Additional context
Workaround

Pinning a known-available port and restarting Copilot CLI allowed authentication to complete:

"auth": {
  "redirectPort": 47000
}

The problem is intermittent. Authentication later worked without the override, possibly because credentials were cached or automatic port selection chose a usable port.

Environment
  • Copilot CLI: 1.0.79
  • Package: 1.0.79-9
  • OS: Windows x64

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the /mcp auth flow and the auth.redirectPort handling that creates the local OAuth callback listener; reproduce the failure on Windows using an OAuth-enabled remote HTTP MCP server without a port override. Done means automatic port selection retries after a bind failure and reports the attempted port if all retries fail.

Written by the indexing model from the issue text.

Assessment

Domain
authentication, cli, networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
67/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.