[BUG] Claude Desktop MCP OAuth callback listener uses a hardcoded port 53280

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Desktop opens a local listener to receive the OAuth callback. The connector uses a hardcoded TCP port, 53280. The connector has no fallback port. The connector does not retry. If the operating system refuses the bind, the setup stops. The browser consent window does not open.

On Windows, Hyper-V, WSL2, Docker Desktop, and the Virtual Machine Platform use the winnat and hns services. These services reserve blocks of the TCP dynamic port range at each start. If a reserved block contains port 53280, the operating system refuses the bind with EACCES. The connector then stops.

Issue #84795 reports the same problem. That issue is closed as not planned and is marked stale. The problem is still present.

Claude Code CLI does not have this problem on the same machine. The CLI requests an OS-assigned port (port 0).

To make the Desktop connector work, I changed the Windows dynamic port range. Then I restarted the machine.

What Should Happen?

The Desktop connector must bind an OS-assigned port (port 0) for the OAuth callback listener. The connector must build the redirect URI from the assigned port. This is the behavior of Claude Code CLI. The connector must not need host port configuration. If a port does not bind, the connector must try a different port.

Error Messages/Logs

# Error message from Desktop client

listen EACCES: permission denied 127.0.0.1:53280

# Host data. Windows, with Hyper-V, WSL2, and Docker Desktop on.

> netsh int ipv4 show dynamicport tcp
Protocol tcp Dynamic Port Range
Start Port      : 53000
Number of Ports : 1000
# A narrow, non-default range. The reservations cover it.

> netsh interface ipv4 show excludedportrange protocol=tcp
   Start Port    End Port
   ----------    --------
        53249       53348      # contains 53280. winnat/hns reservation. no '*'.

> netstat -ano | findstr 53280
# No output. No process listens on the port.
# The operating system refuses the bind. This is EACCES, not EADDRINUSE.

Steps to Reproduce

1. Use a Windows machine. Turn on Hyper-V, WSL2, or Docker Desktop (Virtual Machine Platform). These make winnat and hns reserve dynamic port blocks at each start.
2. Make TCP port 53280 fall inside a reserved block. This occurs on some starts. To force it, run this command as Administrator: netsh int ipv4 set dynamicport tcp start=53000 num=1000. Then restart the machine.
3. Open Claude Desktop. Go to Settings, then Connectors and extensions. Add a remote MCP connector. Set the transport to Streamable HTTP. Use an OAuth-protected MCP server. Keep OAuth at the default.
4. Select Sign in and test.
5. The setup stops with this error: listen EACCES: permission denied 127.0.0.1:53280. The browser window does not open. The connector does not try a different port.
6. Control test: connect the same MCP server from Claude Code CLI on the same machine. The connection succeeds. The CLI uses an OS-assigned port. The redirect URI is different on each run, for example http://localhost:44350/callback.

Claude Model

Not sure / Multiple models

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

1.49585.0 (41ad1d)

Platform

AWS Bedrock

Operating System

Windows

Terminal/Shell

Other

Additional Information

This issue is a follow-up to #84795.

The winnat and hns reservations covered port 53280 at each start. A restart of the winnat service did not fix the problem. Hyper-V sets the reservations again at start.

I was able to work around the issue by moving the dynamic port range above 53280 with this command (as administrator):
netsh int ipv4 set dynamicport tcp start=54000 num=11536

and then restart the machine.