Claude Code MCP authentication invalid_client

[toddams]

Summary

GET /mcp/oauth/authorize rejects the client-ID-metadata-document flow whenever the loopback redirect_uri includes a port. Claude Code always binds an ephemeral port for its callback listener, so the Agent-Native Plan connector can never be authorized from Claude Code — the browser lands on:

{"error":"invalid_client","error_description":"Unknown client or redirect_uri"}

Reproduction

Claude Code uses client_id=https://claude.ai/oauth/claude-code-client-metadata, whose metadata document declares:

"redirect_uris": ["http://localhost/callback", "http://127.0.0.1/callback"]

Same authorize request, varying only redirect_uri:

redirect_uri	Result
http://localhost:3118/callback	400 invalid_client
http://127.0.0.1:3118/callback	400 invalid_client
http://localhost/callback	200, login page renders

The metadata document resolves correctly; only the port breaks the match.

### Environment

- Claude Code 2.1.220, Windows 11
- Plugin `agent-native-visual-plans@agent-native-apps` at `392440ec90d619df3b364cc3cb1cfa409aee1baa`
- Server: `https://plan.agent-native.com/mcp` (hosted)