CIMD declares callback port 33418 but Copilot CLI uses an ephemeral port

Describe the bug

Copilot CLI’s Client ID Metadata Document declares a fixed loopback callback port, but the CLI sends a different ephemeral port in the OAuth authorization request.

Client metadata: https://github.com/copilot/cli/client-metadata.json

{
  "client_id": "https://github.com/copilot/cli/client-metadata.json",
  "application_type": "native",
  "redirect_uris": [
    "http://127.0.0.1:33418/"
  ]
}

The authorization request generated by Copilot CLI instead contains a callback such as:

  redirect_uri=http://127.0.0.1:60005/

My authorization server rejects the request with:

  unauthorized_client: Callback URL mismatch.
  http://127.0.0.1:60005/ is not in the list of allowed callback URLs

Affected version

GitHub Copilot CLI 1.0.83

Steps to reproduce the behavior

1. Configure a remote MCP server protected by an Auth0 authorization server.
2. Register Copilot CLI in Auth0 using: https://github.com/copilot/cli/client-metadata.json
3. Add the remote MCP server to Copilot CLI.
4. Start authentication.
5. Inspect the generated /authorize request.

The request uses an ephemeral loopback port rather than the 33418 port declared in the metadata document.

Expected behavior

The redirect URI used by Copilot CLI should be compatible with its published metadata.

Either:

1. Copilot CLI should bind to the declared callback:

     http://127.0.0.1:33418/
   

2. The metadata should declare a portless loopback callback compatible with ephemeral ports:

     "redirect_uris": [
       "http://127.0.0.1/"
     ]
   

There should not be a requirement for every MCP server operator or Copilot user to configure a callback-port override.

Additional context

• Operating system: macOS 26.5.1
• MCP transport: Streamable HTTP
• Authorization server: Auth0
• Client registration: Client ID Metadata Document

For reference, Claude Code also uses an ephemeral loopback but its metadata document declares port-less loopback callbacks:

  "redirect_uris": [
    "http://localhost/callback",
    "http://127.0.0.1/callback"
  ]

The same Auth0 authorization server accepts Claude Code’s runtime callback while rejecting Copilot CLI’s callback because Copilot’s metadata explicitly pins port 33418.

Claude's metadata: https://claude.ai/oauth/claude-code-client-metadata

从已发布的 client-metadata.json 和生成 /authorize 请求的 Copilot CLI OAuth 授权流程开始。比较声明的重定向 URI 与运行时的回环回调，并确定应统一哪种行为；完成的标准是授权服务器无需按用户覆盖端口即可接受该回调。