[BUG] MCP OAuth callback host is hardcoded — `localhost` breaks Atlassian/Azure allowlists, `127.0.0.1` breaks Salesforce/Slack; needs a host override

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The MCP OAuth loopback redirect_uri host is hardcoded, and the two possible values each break a real set of providers:

• localhost (current, 2.1.231 → 2.1.259) is rejected by IdPs that allowlist only the IP literal: Atlassian with org domain restrictions (#82096), CIMD users (#56557), Azure AD app registrations with 127.0.0.1 (#63030). RFC 8252 §8.3 also says localhost is NOT RECOMMENDED for the loopback redirect.
• 127.0.0.1 (2.1.229 → 2.1.230) is rejected by providers that require the literal string localhost: Salesforce (#86233), Slack's pre-registered client (2.1.231 changelog).

2.1.229 flipped to 127.0.0.1 to fix #82096; 2.1.231 flipped back to localhost to fix #86233. Both issues are now closed, but one of the two camps is always broken. Current 2.1.259 bundle:

p=3118;function DPe(t=p){return`http://localhost:${t}/callback`}

Only the port is configurable (MCP_OAUTH_CALLBACK_PORT, --callback-port, oauth.callbackPort). MCP_OAUTH_CLIENT_METADATA_URL does not affect the host either. The only code path with a custom redirectUri is the internal mcp_authenticate control request (desktop app / SDK), not reachable from the CLI.

What Should Happen?

Either (or both):

1. Make the host configurable, mirroring the existing port knobs: MCP_OAUTH_CALLBACK_HOST, claude mcp add ... --callback-host 127.0.0.1, and oauth.callbackHost in .mcp.json. The listener already binds to 127.0.0.1, so nothing else needs to change.
2. Pick the default by registration mode: 127.0.0.1 for dynamically registered clients (spec-correct per RFC 8252 §7.3), localhost only when a pre-registered --client-id is supplied — that is the case where the provider dictates the exact string.

Steps to Reproduce

1. Org whose IdP allowlists only http://127.0.0.1:<port>/callback (e.g. Atlassian Cloud with domain restrictions enabled).
2. claude mcp add --transport http atlassian https://mcp.atlassian.com/v2/mcp
3. /mcp → authenticate.
4. Consent screen shows http://localhost:3118/callback as the registered domain and the browser is stopped with "Your admin has blocked this domain".

Workaround today: claude mcp add atlassian -- npx -y mcp-remote https://mcp.atlassian.com/v2/mcp --host 127.0.0.1.

Claude Code Version

2.1.259

Platform

macOS