[BUG] VSCode extension's /mcp OAuth flow ignores configured --callback-port (uses a different port than the terminal CLI)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet (closest is the closed/stale #64893, which is a related but distinct symptom — see below)
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When authenticating a project-scoped ("local") HTTP+OAuth MCP server via the VSCode native extension's own /mcp → "Authenticate" flow, the extension ignores the server's configured --callback-port and opens the browser with a redirect_uri on a different, seemingly arbitrary local port instead. If the OAuth provider only whitelists one fixed callback port (a common requirement for third-party OAuth apps), authentication fails with a "Callback URL mismatch" error from the provider — even though the server config is correct.

Repro details:

• Added an HTTP+OAuth MCP server via the terminal CLI: claude mcp add zendesk-mcp https://mcp.swifteq.com/api/mcp/sse --transport http --callback-port 8080 (the OAuth provider only whitelists http://localhost:8080/callback).
• claude mcp get zendesk-mcp correctly shows OAuth: callback_port 8080.
• Inside a Claude Code session running in the VSCode extension, opened /mcp, selected the server, clicked Authenticate. The browser opened https://auth.<provider>.com/authorize?...&redirect_uri=http://localhost:44770/callback... — port 44770, not the configured 8080. The provider correctly rejected it ("Callback URL mismatch. The provided redirect_uri is not in the list of allowed callback URLs.").
• Removed and re-added the server via the CLI with --callback-port 8080 again (in case a stale add caused it) — the extension's Authenticate button still produced the exact same wrong port (44770) on a subsequent attempt.
• As a workaround, ran the interactive terminal claude CLI (not the VSCode extension) in the same project directory, used /mcp there, and clicked Authenticate — this time the redirect correctly used http://localhost:8080/callback, and login succeeded. claude mcp get zendesk-mcp afterwards showed Status: ✔ Connected.
• However, a fresh VSCode-extension-hosted Claude Code session for the same project (same local-scoped ~/.claude.json entry, confirmed same scope/path), even after a full "Developer: Reload Window" and starting a brand-new session, still reports the server under "MCP servers that require authentication" and its tools are not available — i.e. the token obtained via the terminal CLI's flow does not become usable inside the VSCode-extension-hosted session.

This looks related to #64893 (callback-port not respected during /mcp auth) but is a distinct manifestation: in #64893 the redirect_uri itself was correct but the local listener wasn't bound; here, the VSCode extension's own /mcp flow substitutes a different port into the redirect_uri outright, and a token obtained out-of-band via the terminal CLI doesn't get picked up by the extension-hosted session either.

What Should Happen?

• The VSCode extension's /mcp "Authenticate" flow should use the server's configured --callback-port, same as the terminal CLI's /mcp flow does.
• A successful OAuth login for a given local-scoped MCP server (obtained via any Claude Code surface — terminal CLI or VSCode extension) should be usable by any other Claude Code session pointed at that same project/config entry, without requiring a separate re-authentication per surface.

Error Messages/Logs

Oops!, something went wrong
Callback URL mismatch.
The provided redirect_uri is not in the list of allowed callback URLs.
Please go to the Application Settings page and make sure you are sending a valid callback url from your application.

Observed redirect_uri: http://localhost:44770/callback (expected http://localhost:8080/callback, matching the configured --callback-port 8080).

Steps to Reproduce

1. claude mcp add <name> <url> --transport http --callback-port 8080 (any HTTP+OAuth MCP server whose provider whitelists only localhost:8080/callback).
2. Open Claude Code inside the VSCode native extension, in the same project directory.
3. Run /mcp, select the server, click Authenticate.
4. Observe the browser's OAuth authorize URL: redirect_uri is not http://localhost:8080/callback but a different local port.
5. Provider rejects the callback URL.
6. As a contrast, run the interactive terminal claude CLI (outside the VSCode extension) in the same directory, repeat /mcp → Authenticate — the redirect_uri correctly uses port 8080 and login succeeds.
7. Back in a VSCode-extension-hosted session (even a brand-new one, after Reload Window), the server still shows as needing authentication.

Claude Model

Sonnet (default)

Is this a regression?

Unknown — first time configuring an OAuth MCP server with a pinned callback port inside the VSCode extension.