[BUG] Claude Desktop v1.1.7053 spawns two mcp-remote processes simultaneously during MCP server initialization, causing OAuth PKCE auth to fail

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Bug Description

Claude Desktop v1.1.7053 spawns two mcp-remote processes simultaneously during MCP server initialization, causing OAuth PKCE auth to fail every time. This is a regression — the same configuration worked correctly on the previous version.

Environment

• Claude Desktop version: 1.1.7053 (cc1949) 2026-03-16T22:55:50.000Z
• OS: Windows 11
• mcp-remote version: 0.1.37
• Node.js version: 25.2.1

Configuration

{
  "mcpServers": {
    "Scholar Gateway Dev": {
      "command": "mcp-remote",
      "args": [
        "https://connector-dev-v3.scholargateway.ai/mcp"
      ]
    }
  }
}

Steps to Reproduce

1. Configure any remote MCP server via mcp-remote in claude_desktop_config.json
2. Launch Claude Desktop
3. Observe MCP server logs

Expected Behavior

A single mcp-remote process spawns, completes OAuth auth, and connects successfully.

Actual Behavior

Claude Desktop performs an intentional shutdown immediately after receiving the initialize message, then restarts the server within milliseconds. This spawns a second mcp-remote process while the first is still waiting on OAuth auth. Both processes generate different PKCE code challenges. The second process crashes with EADDRINUSE on the OAuth callback port. The auth code returned by the browser is matched against the wrong PKCE verifier, resulting in InvalidGrantError: Invalid PKCE code_verifier.

This failure is 100% reproducible and affects all remote MCP endpoints, not just a specific server.

Key Log Evidence

The shutdown/restart cycle happens within ~100ms of initialization:

[info] Server started and connected successfully
[info] Message from client: {"method":"initialize",...}
[info] Client transport closed
[info] Server transport closed (intentional shutdown)   ← triggers second spawn
[info] Initializing server...
[info] Server started and connected successfully        ← second process

Two processes with different PKCE challenges then race for the OAuth callback port:

[PID A] code_challenge=<challenge_A> → wins port 4390, opens browser
[PID B] code_challenge=<challenge_B> → EADDRINUSE, crashes
[PID A] Auth code received → InvalidGrantError: Invalid PKCE code_verifier

Workarounds Attempted

• Added --port 4390 to mcp-remote args — double-spawn persists
• Cleared mcp-remote token cache — no cache directory exists on this machine
• Killed all node processes before launch — no change
• Verified config has only one server entry — confirmed clean

Additional Notes

This affects multiple remote MCP endpoints, confirming it is a Claude Desktop regression rather than a server-specific issue. The previous Claude Desktop version did not exhibit this behaviour.

What Should Happen?

Expected Behavior

A single mcp-remote process spawns, completes OAuth auth, and connects successfully.

Error Messages/Logs

2026-03-17T11:23:36.088Z [Scholar Gateway Dev] [info] Server started and connected successfully { metadata: undefined }
2026-03-17T11:23:36.904Z [Scholar Gateway Dev] [info] Message from client: {"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{"extensions":{"io.modelcontextprotocol/ui":{"mimeTypes":["text/html;profile=mcp-app"]}}},"clientInfo":{"name":"claude-ai","version":"0.1.0"}},"jsonrpc":"2.0","id":0} { metadata: undefined }
[25428] Using existing client port: 4390
[25428] Discovering OAuth server configuration...
[29520] Using existing client port: 4390
[29520] Discovering OAuth server configuration...
[25428] [25428] Connecting to remote server: https://connector-dev-v3.scholargateway.ai/mcp
[29520] [29520] Connecting to remote server: https://connector-dev-v3.scholargateway.ai/mcp
[25428] Using transport strategy: http-first
[29520] Using transport strategy: http-first
[25428] 
Please authorize this client by visiting:
https://connector-dev-v3.scholargateway.ai/authorize?response_type=code&client_id=u9pSW26ToNrwkVKJ&code_challenge=b0Oc2vf2EnZpgpMtUmv6sd-XID7X04lHRa_cA7905fo&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A4390%2Foauth%2Fcallback&state=e147d9b8-1ae6-4585-ba8a-daeebfc2ac6d&scope=openid+email+profile

[29520] 
Please authorize this client by visiting:
https://connector-dev-v3.scholargateway.ai/authorize?response_type=code&client_id=u9pSW26ToNrwkVKJ&code_challenge=YiJm7wv_HQOttOkYTaeuciLbXpngOzscbIz2zZLLbtE&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A4390%2Foauth%2Fcallback&state=50d5da6a-a41b-4c0e-850b-19dcefb57e3f&scope=openid+email+profile

[25428] Browser opened automatically.
[29520] Browser opened automatically.
[25428] Authentication required. Initializing auth...
[25428] Initializing auth coordination on-demand
[29520] Authentication required. Initializing auth...
[29520] Initializing auth coordination on-demand
[29520] OAuth callback server running at http://127.0.0.1:4390
[29520] Creating lockfile for server b717f1cfef8325e90390b94759fcb1f3 with process 29520 on port 4390
node:events:486
      throw er; // Unhandled 'error' event
      ^

Error: listen EADDRINUSE: address already in use 127.0.0.1:4390
    at Server.setupListenHandle [as _listen2] (node:net:1940:16)
    at listenInCluster (node:net:1997:12)
    at node:net:2206:7
    at process.processTicksAndRejections (node:internal/process/task_queues:89:21)
Emitted 'error' event on Server instance at:
    at emitErrorNT (node:net:1976:8)
    at process.processTicksAndRejections (node:internal/process/task_queues:89:21) {
  code: 'EADDRINUSE',
  errno: -4091,
  syscall: 'listen',
  address: '127.0.0.1',
  port: 4390
}

Node.js v25.2.1
[29520] Authentication required. Waiting for authorization...
2026-03-17T11:23:38.862Z [Scholar Gateway Dev] [info] Server transport closed { metadata: undefined }
2026-03-17T11:23:38.863Z [Scholar Gateway Dev] [info] Client transport closed { metadata: undefined }
[29520] Auth code received, resolving promise
[29520] Completing authorization...
[29520] Authorization error: InvalidGrantError: Invalid PKCE code_verifier
    at parseErrorResponse (file:///C:/Users/lwylie/AppData/Roaming/npm/node_modules/mcp-remote/dist/chunk-F76MHFRJ.js:17141:12)
    at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
    at async exchangeAuthorization (file:///C:/Users/lwylie/AppData/Roaming/npm/node_modules/mcp-remote/dist/chunk-F76MHFRJ.js:17504:11)
    at async authInternal (file:///C:/Users/lwylie/AppData/Roaming/npm/node_modules/mcp-remote/dist/chunk-F76MHFRJ.js:17211:21)
    at async auth (file:///C:/Users/lwylie/AppData/Roaming/npm/node_modules/mcp-remote/dist/chunk-F76MHFRJ.js:17157:14)
    at async StreamableHTTPClientTransport.finishAuth (file:///C:/Users/lwylie/AppData/Roaming/npm/node_modules/mcp-remote/dist/chunk-F76MHFRJ.js:18427:20)
    at async connectToRemoteServer (file:///C:/Users/lwylie/AppData/Roaming/npm/node_modules/mcp-remote/dist/chunk-F76MHFRJ.js:19185:9)
    at async runProxy (file:///C:/Users/lwylie/AppData/Roaming/npm/node_modules/mcp-remote/dist/proxy.js:157:29) {
  errorUri: undefined
}
[29520] Fatal error: InvalidGrantError: Invalid PKCE code_verifier
    at parseErrorResponse (file:///C:/Users/lwylie/AppData/Roaming/npm/node_modules/mcp-remote/dist/chunk-F76MHFRJ.js:17141:12)
    at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
    at async exchangeAuthorization (file:///C:/Users/lwylie/AppData/Roaming/npm/node_modules/mcp-remote/dist/chunk-F76MHFRJ.js:17504:11)
    at async authInternal (file:///C:/Users/lwylie/AppData/Roaming/npm/node_modules/mcp-remote/dist/chunk-F76MHFRJ.js:17211:21)
    at async auth (file:///C:/Users/lwylie/AppData/Roaming/npm/node_modules/mcp-remote/dist/chunk-F76MHFRJ.js:17157:14)
    at async StreamableHTTPClientTransport.finishAuth (file:///C:/Users/lwylie/AppData/Roaming/npm/node_modules/mcp-remote/dist/chunk-F76MHFRJ.js:18427:20)
    at async connectToRemoteServer (file:///C:/Users/lwylie/AppData/Roaming/npm/node_modules/mcp-remote/dist/chunk-F76MHFRJ.js:19185:9)
    at async runProxy (file:///C:/Users/lwylie/AppData/Roaming/npm/node_modules/mcp-remote/dist/proxy.js:157:29) {
  errorUri: undefined
}
2026-03-17T11:23:45.501Z [Scholar Gateway Dev] [info] Server transport closed { metadata: undefined }
2026-03-17T11:23:45.501Z [Scholar Gateway Dev] [info] Client transport closed { metadata: undefined }
2026-03-17T11:23:45.501Z [Scholar Gateway Dev] [info] Server transport closed unexpectedly, this is likely due to the process exiting early. If you are developing this MCP server you can add output to stderr (i.e. `console.error('...')` in JavaScript, `print('...', file=sys.stderr)` in python) and it will appear in this log. { metadata: undefined }
2026-03-17T11:23:45.501Z [Scholar Gateway Dev] [error] Server disconnected. For troubleshooting guidance, please visit our [debugging documentation](https://modelcontextprotocol.io/docs/tools/debugging) { metadata: { context: 'connection', stack: undefined } }
2026-03-17T11:23:45.502Z [Scholar Gateway Dev] [info] Client transport closed { metadata: undefined }

Steps to Reproduce

Steps to Reproduce

1. Configure any remote MCP server via mcp-remote in claude_desktop_config.json
2. Launch Claude Desktop
3. Observe MCP server logs

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

desktop v1.1.7053

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other

Additional Information

_No response_