Linear MCP OAuth fails with "Invalid client" — metadata-URL clientId + ephemeral loopback port

Description

Linear MCP (https://mcp.linear.app/mcp) rejects Claude Code's OAuth authorize request with:

Invalid client. The clientId provided does not match to this client.

Every new session requires re-authentication because no refresh token is ever obtained (auth never completes). Clearing mcpOAuth from the keychain, removing/re-adding the server, and revoking the app in Linear all fail to fix it.

Environment

• Claude Code: 2.1.104
• macOS 25.3.0 (Darwin)
• MCP server: https://mcp.linear.app/mcp (http transport)

Root cause (suspected)

Claude Code uses the Client ID Metadata Document spec — sending its metadata URL as the client_id:

client_id=https://claude.ai/oauth/claude-code-client-metadata

That metadata doc declares:

{
  "redirect_uris": ["http://localhost/callback", "http://127.0.0.1/callback"],
  ...
}

But Claude Code sends an ephemeral loopback port in the actual authorize request:

redirect_uri=http://localhost:53076/callback

Linear advertises client_id_metadata_document_supported: true and appears to do strict matching of redirect_uri against the declared list, which doesn't include a port. Per RFC 8252 §7.3, servers MUST allow any port for loopback redirect URIs — but it's ambiguous how this interacts with the Client ID Metadata Document draft.

Either:

• Claude's metadata doc should declare http://localhost:*/callback (or equivalent port-wildcard form), or
• Claude should send port-less loopback URIs, or
• Linear should honor RFC 8252's port-wildcard rule here.

Logs

From ~/Library/Caches/claude-cli-nodejs/<project>/mcp-logs-linear-server/*.jsonl:

{"debug":"No client info found"}
{"debug":"Token expired without refresh token"}
{"debug":"Authorization URL: https://mcp.linear.app/authorize?response_type=code&client_id=https%3A%2F%2Fclaude.ai%2Foauth%2Fclaude-code-client-metadata&...&redirect_uri=http%3A%2F%2Flocalhost%3A53076%2Fcallback&..."}
{"debug":"Scopes in URL: NOT FOUND"}
{"debug":"Error during auth completion: AuthenticationCancelledError: Authentication was cancelled"}

Browser lands on Linear's /authorize page showing the "Invalid client" error before the user can consent.

Steps to reproduce

1. claude mcp add --transport http linear-server https://mcp.linear.app/mcp
2. /mcp → authenticate Linear
3. Browser shows "Invalid client. The clientId provided does not match to this client."

Related

• #28256 — MCP OAuth token refresh not persisting (Notion) — same shape
• #5706 — Missing token refresh mechanism for MCP
• #38102, #26675 — MCP OAuth DCR/clientId handling