workiq MCP server auth fails in VS Code: platform_broker_error → 401 InvalidAuthenticationToken

Summary

Following the "Via MCP Configuration" setup guidance in the plugin README (permalink), the workiq MCP server fails to start/authenticate in VS Code. Sign-in never triggers an interactive prompt, and the server connection ends in a 401 InvalidAuthenticationToken error with an empty access token.

Environment

• Client: VS Code 1.133.0 (commit a5b500951314efd502d07465bd138dfbd714a960), arm64
• OS: macOS 26.6.1 (build 25G76)
• MCP config format used: VS Code user mcp.json ("servers" key), adapted from the README's mcpServers example since VS Code's schema for HTTP servers only supports type, url, and oauth.clientId (no oauthPublicClient / auth.redirectPort fields exist in VS Code's MCP schema — see MCP configuration reference):

{
  "servers": {
    "workiq": {
      "type": "http",
      "url": "https://workiq.svc.cloud.microsoft/mcp",
      "oauth": {
        "clientId": "ba081686-5d24-4bc6-a0d6-d034ecffed87"
      }
    }
  }
}

Steps to reproduce

1. Add the workiq MCP server per the README guidance (adapted to the client's schema as above).
2. Start the server (MCP: List Servers → workiq → Start).
3. Attempt sign-in when prompted.

Expected behavior

An interactive OAuth sign-in flow completes, a valid access token is attached to MCP requests, and the server starts successfully.

Actual behavior

No interactive sign-in prompt appears. The server log shows MSAL attempting silent token acquisition via the native platform broker, which fails, after which an empty bearer token is sent to the server and rejected:

[info] Starting server workiq
[info] Connection state: Starting
[info] Discovered resource metadata at https://workiq.svc.cloud.microsoft/.well-known/oauth-protected-resource/mcp
[info] Using auth server metadata url: https://login.microsoftonline.com/organizations/v2.0
[warning] Error fetching authorization server metadata: Error: Failed to fetch authorization server metadata from https://login.microsoftonline.com/.well-known/oauth-authorization-server/organizations/v2.0: 404
[warning] Error fetching authorization server metadata: Error: Failed to fetch authorization server metadata from https://login.microsoftonline.com/.well-known/openid-configuration/organizations/v2.0: 404
[info] Discovered authorization server metadata at https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration
[info] Waiting for server to respond to `initialize` request...
[warning] Error getting token from server metadata: ClientAuthError: platform_broker_error: See https://aka.ms/msal.js.errors#platform_broker_error for details
[info] Connection state: Error 401 status sending message to https://workiq.svc.cloud.microsoft/mcp: {"error":{"code":"InvalidAuthenticationToken","message":"Access token is empty."}}

This sequence repeated identically across multiple restart attempts.

Notes / possible causes

• Per MSAL.js error docs, platform_broker_error means "An error occurred in the native broker." The client appears to fall back to sending an empty token instead of surfacing an interactive login, so the user is never given a chance to authenticate.
• The two 404 responses while discovering authorization server metadata (.well-known/oauth-authorization-server/organizations/v2.0 and .well-known/openid-configuration/organizations/v2.0 before falling back to /organizations/v2.0/.well-known/openid-configuration) may be expected MSAL fallback behavior, but are noted here in case they're relevant.
• Separately, the README's mcpServers example (oauthClientId, oauthPublicClient, auth.redirectPort) does not match VS Code's actual MCP oauth schema (clientId only). It's unclear which MCP client(s) the documented format targets; clarifying this in the README (or providing a VS Code-specific snippet) would help.

Ask

Could someone confirm:

1. Whether this is a known issue with the hosted workiq.svc.cloud.microsoft/mcp endpoint's OAuth flow in VS Code specifically, or a client-side (VS Code MSAL broker) issue.
2. Whether there's a workaround to force interactive (non-broker) sign-in for this server.

CC: @darrelmiller

Start with plugins/workiq/README.md lines 15-30 and reproduce the setup using VS Code's user mcp.json configuration. Compare the authentication flow and logs around platform_broker_error and the empty bearer token, then determine whether the failure is in the hosted endpoint or the VS Code client. Done means documenting a confirmed cause and workaround, or clarifying the README with a valid VS Code configuration.