Forumics logo Forumics
Issue 01

Back to issue

All Claude Code known issues

CLAIM C033 Supported 2026-10-31

GitHub issue #42765 in anthropics/claude-code, opened 2026-04-02 by alzerid, records a report that the Claude Code OAuth client uses a localhost callback URI on an ephemeral port when authenticating with MCP servers, which the reporter says violates RFC 8252 Section 7.3 because native apps must use loopback IP literals, so authorization servers that strictly follow the RFC reject the redirect URI for lack of dynamic port matching.

Verbatim Excerpts from Cited Records
“Since Claude Code uses ephemeral ports (e.g. `http://localhost:54738/callback`), and `localhost` does not qualify for dynamic port matching, the redirect URI fails validation.”
— alzerid · anthropics/claude-code (issue 42765 opening body, What is Wrong section) · 2026-04-02T19:56:13Z ·GitHub Issue ↗
“which specifies that native apps MUST use loopback **IP literals** (`127.0.0.1` or `::1`), not the `localhost` hostname.”
— alzerid · anthropics/claude-code (issue 42765 opening body, What is Wrong section) · 2026-04-02T19:56:13Z ·GitHub Issue ↗
“Any OAuth authorization server that strictly implements RFC 8252 will reject Claude Code's redirect URI.”
— alzerid · anthropics/claude-code (issue 42765 opening body, Real-World Impact section) · 2026-04-02T19:56:13Z ·GitHub Issue ↗
Counter-record: Issue remains open as of 2026-10-30 with 18 comments. A bot comment on filing day flagged possible duplicate issue 14079, but the issue stayed open and the thread continued. Surveyed comments include confirmations against Spring Authorization Server, Keycloak, Teamwork hosted MCP, Stack Overflow for Agents and Okta through 2026-10-29, plus a reporter note that the earlier issue 14079 was auto-closed for inactivity without human evaluation. No maintainer resolution appears in the surveyed thread. Falsification probe: If issue #42765 is deleted without archive, if the author edits the opening body so the quoted lines no longer match verbatim, or if the author or maintainers post a definitive retraction showing the described behavior was mischaracterized, this claim drops to Withdrawn. Audit verification: Verified 100% continuous verbatim substring against official GitHub REST API by scripts/verify_claim_verbatim.py.