[BUG] MCP OAuth callback server has ~19 second TTL, too short for real-world identity providers

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

What's Wrong?
When authenticating an MCP server that uses OAuth, Claude Code starts a
temporary local HTTP server to receive the OAuth callback. This server is
cleaned up after approximately 19 seconds, which is insufficient for
enterprise identity providers like Microsoft 365 / Entra ID that require
multi-step login (email, password, MFA).

The browser successfully completes authentication and redirects to the
callback URL, but the local server has already been torn down, leaving the
browser hanging with no response. The same MCP server and OAuth configuration
works correctly in VS Code and Cursor.

Bug confirmed by manually replicating the OAuth flow with a local Python HTTP
server running with no timeout — the full M365 login (including MFA) took
well over 19 seconds, but the callback was received successfully and the token
exchange completed. Claude Code's 19-second window is the sole failure point.

Manual Workaround Used to Confirm Bug:

1. Inspected ~/.claude/.credentials.json — found stale token with expiresAt: 0
2. Confirmed ~/.claude/mcp-needs-auth-cache.json had server flagged as needing auth
3. Dynamically registered a new public OAuth client via the registration_endpoint

with http://localhost:7823/callback as redirect_uri

1. Generated PKCE (S256) parameters, started a local Python HTTP server on port

7823 with no timeout, opened the authorization URL in the browser

1. Completed M365/Entra ID login including MFA (took well over 19 seconds)
2. Callback received successfully — code exchanged for bearer token (expires_in: 3600)
3. Token written to ~/.claude/.credentials.json manually — MCP server connected successfully

Conclusion: OAuth flow completes without issue when the callback server has no
TTL. The 19-second window in Claude Code is the sole failure point.

Server Configuration (confirmed correct):
GET /mcp → 401 JSON with proper WWW-Authenticate header
GET /.well-known/oauth-protected-resource/mcp → 200 JSON ✅
GET /.well-known/oauth-authorization-server → 200 JSON ✅

OAuth flow works in VS Code and Cursor with the same server.

Suggested Fix:
Increase the OAuth callback server TTL from ~19 seconds to a minimum of 3
minutes, or make it user-configurable (e.g. via settings.json).

Claude Code Version: 2.1.63

Platform: macOS 15.3, Apple M2

Reproduced in: Terminal.app (Claude Code standalone) and VS Code integrated terminal

What Should Happen?

The callback server should remain alive long enough for real-world enterprise
login flows to complete. A minimum of 3 minutes is recommended to accommodate
MFA, SSO redirects, and consent screens. Making this value configurable would
also help.

Error Messages/Logs

Debug Log Evidence:
  22:08:47 [DEBUG] MCP server "hourzero": Opening authorization URL
  22:08:47 [DEBUG] MCP server "hourzero": Initial auth result: REDIRECT
  22:09:06 [DEBUG] MCP server "hourzero": MCP OAuth server cleaned up  ← 19s later

  The callback URL remained in the browser with a valid code and state —
  auth succeeded on the IdP side, Claude Code was just no longer listening.

Steps to Reproduce

1. Configure an MCP server using OAuth with Microsoft 365 / Entra ID as the

identity provider (via Supabase Auth)

1. Run /mcp and trigger authentication in Claude Code CLI
2. Browser opens Microsoft login page
3. Complete M365 login (email + password + MFA — typically 20–60 seconds)
4. Browser redirects to http://localhost:{PORT}/callback?code=...&state=...
5. Browser hangs — Claude Code's callback server is already cleaned up

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.63

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_