MCP OAuth flow broken: servers marked needs-auth during discovery, connections drop after ~90s

[Joachim-Ally-Skyline]

Description

MCP servers requiring OAuth (both Azure AD and Microsoft Work IQ / agent365) fail to connect during session startup. The OAuth flow is initiated but immediately cancelled because no auth handler is registered, leaving servers permanently marked as needs-auth. Even when retries eventually succeed (Work IQ servers connect after ~15-30s of retries), the connections drop ~90 seconds later.

The MCP servers settings page shows all servers as green/healthy, but tools from these servers are never available in sessions.

Affected servers

Server	URL pattern	Behavior
SkylineApi (Azure AD OAuth)	collaboration-mcp-server.*.azurecontainerapps.io/mcp	Never connects — OAuth cancelled immediately
Work IQ Calendar/Mail/Teams/OneDrive/Word	agent365.svc.cloud.microsoft/agents/tenants/*/servers/*	Connects after retries (~15-30s) but disconnects ~90s later

Steps to reproduce

1. Configure HTTP MCP servers that require OAuth in ~/.copilot/mcp-config.json (e.g. Work IQ servers or any Azure AD-protected MCP endpoint)
2. Open the Copilot app — MCP servers settings page shows all servers as green ✅
3. Start a new session (chat or project session)
4. Try to use any tool from an OAuth-protected server — tools are not available

Log evidence

From process-*.log during session startup:

Phase 1 — OAuth request sent to extension instead of built-in handler:

[INFO] [extension:...\task-housekeeping\extension.mjs] Received MCP OAuth request without a registered MCP auth handler. SessionId=..., RequestId=...
[ERROR] OAuth handler did not provide credentials for SkylineApi (cancelled); marking as needs-auth
[ERROR] OAuth required for SkylineApi with no cached tokens; marking as needs-auth

Phase 2 — Work IQ servers fail with same pattern, then retry-connect, then drop:

[ERROR] Server Work IQ Calendar requires authentication, initiating OAuth flow
[ERROR] OAuth handler did not provide credentials for Work IQ Calendar (cancelled); marking as needs-auth
...
# After multiple retries (~15-30 seconds later):
[ERROR] MCP client for Work IQ Calendar connected, took 3022ms
...
# ~90 seconds after connecting:
[ERROR] MCP connection for Work IQ Calendar closed
[ERROR] MCP connection for Work IQ Mail closed
[ERROR] MCP connection for Work IQ Teams closed

Phase 3 — Work IQ Mail also hits 502 on first attempt:

[ERROR] Failed to start MCP client for remote server Work IQ Mail: Error: failed to initialize MCP client: Send message error ... unexpected server response: HTTP 502 Bad Gateway

Key observations

1. The OAuth request is routed to a user extension (task-housekeeping) which correctly reports it has no MCP auth handler registered — but the app should be using its own built-in OAuth handler, not delegating to extensions.
2. The needs-auth state appears permanent for the session — no browser popup or auth prompt is shown to the user.
3. The green status on the MCP servers settings page is misleading — it reflects config validity, not actual connection/auth state.
4. This is 100% reproducible across all new sessions.

Expected behavior

• OAuth-protected MCP servers should trigger a browser-based OAuth flow (popup or redirect) on first use, cache tokens, and auto-refresh them.
• The MCP servers settings page should reflect actual connection state, not just config validity.
• OAuth requests should go through the app's built-in OAuth handler, not be dispatched to user extensions.

Environment

• App version: 1.0.19
• OS: Windows 11
• CLI version: bundled with app v1.0.19
• Config location: ~/.copilot/mcp-config.json
• Extensions: 1 user extension (task-housekeeping) — not related to OAuth