Atlassian MCP OAuth fails: redirect_uri port doesn't match declared client-metadata.json

[ryan-novak-nextech]

Copilot CLI version: 1.0.87
OS: macOS 26.6.1 (Build 25G76), arm64
Network: Corporate device with Zscaler installed (flagged for completeness; not confirmed as root cause)

Steps to reproduce

1. Configure Atlassian MCP server (https://mcp.atlassian.com/v2/mcp) via mcp-config.json.
2. Trigger OAuth flow via /mcp reconnect.
3. Open the generated authorization URL.

Expected

Successful redirect back to CLI's local callback listener, completing MCP OAuth.

Actual

Atlassian returns: "Hmm... We're having trouble logging you in. The app's callback URL is invalid. Contact the app developer to fix the redirect URL in the app's settings." (Error ID: 3f13556b-e3e0-4b4e-ab76-8b0819b515c0)

Root cause observed

• The CLI's client-metadata document (https://github.com/copilot/cli/client-metadata.json) declares a fixed redirect_uris: ["http://127.0.0.1:33418/"].
• The actual authorization request generated by the CLI used redirect_uri=http://127.0.0.1:55319/ — a different, seemingly random ephemeral port.
• Atlassian validates the redirect URI against the declared metadata and rejects the mismatch.
• Retried the flow multiple times (different random ports each time); restarted computer; updated CLI to the latest available version (1.0.87) — issue persists.

Suggested fix

The CLI's local OAuth callback listener should bind to the fixed port (33418) declared in its own client-metadata document, rather than an ephemeral/random port, for OAuth providers (like Atlassian) that strictly validate the redirect URI against pre-registered client metadata.

[ryan-novak-nextech]

Duplicate of #4901 — same root cause (Copilot CLI's OAuth redirect_uri uses a random loopback port that doesn't match the port declared/registered in client metadata for the Atlassian MCP OAuth flow). Closing in favor of the earlier, more detailed report.