[BUG] CIMD redirect_uri mismatch: metadata declares portless localhost but auth request includes ephemeral port

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Code's CIMD metadata document at https://claude.ai/oauth/claude-code-client-metadata declares:

{
"redirect_uris": ["http://localhost/callback", "http://127.0.0.1/callback"]
}

However, the actual authorization request uses an ephemeral port like:

redirect_uri=http://localhost:58135/callback

Since CIMD requires exact-match validation of redirect_uri against the declared redirect_uris, MCP servers that perform strict validation (such as https://github.com/jlowin/fastmcp) reject the request with a following message:

Redirect URI 'http://localhost:<ephemeral_port>/callback' does not match CIMD redirect_uris.

While RFC 8252 (OAuth 2.0 for Native Apps) recommends that authorization servers ignore the port for loopback redirects, the CIMD spec relies on exact string matching per RFC 6749 / OpenID Connect, and not all　implementations apply the RFC 8252 loopback exception.

What Should Happen?

The OAuth flow should complete successfully with CIMD-enabled MCP servers. Either:

• The CIMD metadata should declare redirect_uris that match what Claude Code actually sends (e.g., include a wildcard or use a mechanism compatible with

ephemeral ports), or

• Claude Code should use a redirect_uri that matches its declared CIMD metadata

Error Messages/Logs

Steps to Reproduce

1. Set up an MCP server using FastMCP (which supports CIMD and performs exact-match redirect_uri validation)
2. Connect to it from Claude Code v2.1.81
3. Claude Code starts the OAuth flow with client_id=https://claude.ai/oauth/claude-code-client-metadata
4. The MCP server fetches the metadata, sees redirect_uris: ["http://localhost/callback", ...]
5. The authorization request arrives with redirect_uri=http://localhost:<random-port>/callback
6. Exact-match validation fails → error

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.78

Claude Code Version

2.1.81

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

_No response_