›_ Claude Code Issues
Claude Code Issues / #73114

[BUG] MCP OAuth authorization URL wraps in terminal — Ctrl+click opens truncated link

Open 💬 0 comments Opened Jul 2, 2026 by jarrettgsmith

Preflight Checklist

  • [x] I have searched existing issues — #72628 is the same root cause in the /login flow; this report covers the MCP server OAuth flow (per-flow reports kept separate)
  • [x] This is a single bug report
  • [x] I am using the latest version of Claude Code

What's Wrong?

When authenticating to a third-party MCP server via OAuth (/mcp → authenticate), the CLI prints the authorization URL for the user to open. The URL is ~370 characters and hard-wraps in the terminal. Ctrl+click then only picks up the first visual line of the wrapped URL, opening a truncated link. The workaround is copying the fragments and reassembling them in a text editor before pasting into a browser.

Observed on Windows 11 (Windows Terminal + PowerShell) against a spec-compliant streamable-HTTP MCP server (TouchDesigner TDMCP) with OAuth 2.1 + PKCE + dynamic client registration.

Caveat: the broken Ctrl+click may be terminal-emulator-specific — URL detection is the emulator's own pattern-matching over visual lines (Windows Terminal detects per line; other emulators may rejoin wrapped lines). Untested here beyond Windows Terminal/PowerShell. That terminal-dependence is itself the argument for option 1 below: an OSC 8 hyperlink makes the link explicit instead of relying on each emulator's detection heuristics.

Example URL as printed (single-use values, already spent):

http://localhost:13316/authorize?response_type=code&client_id=WQNYnvZW7_OEAIlgEoJi5ULCca-a0d5g&code_challenge=MX9IeV0APU6jSKsCGHx_-zkecp-WRKTE-lI2T3qWaNQ&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A43351%2Fcallback&state=NGPK840GZMZCKZnlitkJDeFrP42-wwXhyYTR-97tl0g&resource=http%3A%2F%2Flocalhost%3A13316%2Fmcp

Note the length is inherent to a correct MCP OAuth request — state (43 chars) and code_challenge (43) are Claude Code's own PKCE values, and resource is the RFC 8707 parameter the MCP spec requires clients to send — so no server can make this URL short.

What Should Happen?

Any of:

  1. Emit the URL as an OSC 8 hyperlink with short display text (e.g. Open authorization page) so terminal wrapping can't break the clickable region — this fixes it for every long-URL OAuth server at once.
  2. Auto-open the browser for MCP OAuth the way /login attempts to, printing the URL only as fallback.
  3. Print the URL on its own line with no indentation/prefix so at minimum a triple-click selects it whole.

Related

  • #72628 — same wrapping root cause in the /login flow (WebStorm terminal, breaks state param on copy). A common fix (OSC 8 hyperlink) would resolve both.

Steps to Reproduce

  1. Register an OAuth-enabled MCP server: claude mcp add --transport http tdmcp http://localhost:13316/mcp (TDMCP with Auth enabled, or any OAuth 2.1 MCP server)
  2. In Claude Code, run /mcp and choose to authenticate
  3. Observe the printed authorization URL wraps; Ctrl+click opens only the first line

🤖 Generated with Claude Code

View original on GitHub ↗