Re-Auth fails with localhost refused to connect

[kocsszi]

Hi! I am using a DCR flow. Everything works well, but when either the access token expires (with no refresh token) or when the refresh token expires, after giving consent in the browser popup, the localhost redirect fails with refused to connect.

I looked at netstat -ano | findstr :{port} there seems to be no server process listening for the redirect port.

I see these lines in the logs with --debug

[2025-11-03T21:36:53.724Z][4492] Setting up OAuth callback server {"port":14420}
[2025-11-03T21:36:53.728Z][4492] Fatal error: {}

Other times there is no mention of Setting up the OAuth callback server around the time the browser is opened

Please authorize this client by visiting:
https://test-mcp.acme.com/oauth/authorize?response_type=code&client_id=87GA075d9LdzYqgYLy1vzcjWjIY4wvtk&code_challenge=CQvXGj_9DesvRDno4kbmRUAy6XdGK6LRD-wgfkjpDJw&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A14420%2Foauth%2Fcallback&state=308e5157-dfac-46ce-b13c-75a04b94a0dc&scope=offline_access&prompt=consent

[2025-11-03T16:35:30.394Z][9572] Redirecting to authorization URL https://test-mcp.acme.com/oauth/authorize?response_type=code&client_id=87GA075d9LdzYqgYLy1vzcjWjIY4wvtk&code_challenge=CQvXGj_9DesvRDno4kbmRUAy6XdGK6LRD-wgfkjpDJw&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A14420%2Foauth%2Fcallback&state=308e5157-dfac-46ce-b13c-75a04b94a0dc&scope=offline_access&prompt=consent
[2025-11-03T16:35:30.418Z][9572] Browser opened automatically.
[2025-11-03T16:35:30.419Z][9572] Error from remote server: {}
[2025-11-03T16:35:30.420Z][9572] Error from remote server {"stack":"Error: Unauthorized\n at StreamableHTTPClientTransport.send (file:///C:/Users/kocsszi/AppData/Local/npm-cache/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:13456:19)"}
[2025-11-03T16:35:30.421Z][9572] Error from remote server: {}
[2025-11-03T16:35:30.422Z][9572] Error from remote server {"stack":"Error: Unauthorized\n at StreamableHTTPClientTransport.send (file:///C:/Users/kocsszi/AppData/Local/npm-cache/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:13456:19)"}
[2025-11-03T16:39:28.209Z][9572] [Local→Remote] notifications/cancelled
[2025-11-03T16:39:28.211Z][9572] Local → Remote message {"method":"notifications/cancelled","params":"{"requestId":5,"reason":"McpError: MCP error -32001: Request timed out"}"}
[2025-11-03T16:39:28.213Z][9572] Reading OAuth tokens
[2025-11-03T16:39:28.214Z][9572] Token request stack trace: Error
at NodeOAuthClientProvider.tokens (file:///C:/Users/kocsszi/AppData/Local/npm-cache/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:14308:44)
at StreamableHTTPClientTransport._commonHeaders (file:///C:/Users/kocsszi/AppData/Local/npm-cache/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:13263:47)
at StreamableHTTPClientTransport.send (file:///C:/Users/kocsszi/AppData/Local/npm-cache/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:13436:34)
at transportToClient.onmessage (file:///C:/Users/kocsszi/AppData/Local/npm-cache/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:13762:23)
at StdioServerTransport.processReadBuffer (file:///C:/Users/kocsszi/AppData/Local/npm-cache/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/proxy.js:83:71)
at StdioServerTransport._ondata (file:///C:/Users/kocsszi/AppData/Local/npm-cache/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/proxy.js:57:12)
at Socket.emit (node:events:519:28)
at addChunk (node:internal/streams/readable:561:12)
at readableAddChunkPushByteMode (node:internal/streams/readable:512:3)
at Readable.push (node:internal/streams/readable:392:5)
[2025-11-03T16:39:28.216Z][9572] Token result: Not found
[2025-11-03T16:39:31.760Z][9572] Reading client info
[2025-11-03T16:39:31.766Z][9572] Client info result: Found
[2025-11-03T16:39:31.766Z][9572] Reading OAuth tokens
[2025-11-03T16:39:31.767Z][9572] Token request stack trace: Error
at NodeOAuthClientProvider.tokens (file:///C:/Users/kocsszi/AppData/Local/npm-cache/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:14308:44)
at authInternal (file:///C:/Users/kocsszi/AppData/Local/npm-cache/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:12295:33)
at async auth (file:///C:/Users/kocsszi/AppData/Local/npm-cache/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:12235:12)
at async StreamableHTTPClientTransport.send (file:///C:/Users/kocsszi/AppData/Local/npm-cache/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:13454:26)
[2025-11-03T16:39:31.768Z][9572] Token result: Not found
[2025-11-03T16:39:31.769Z][9572] Saving code verifier
[2025-11-03T16:39:31.771Z][9572]
Please authorize this client by visiting:
https://test-mcp.acme.com/oauth/authorize?response_type=code&client_id=87GA075d9LdzYqgYLy1vzcjWjIY4wvtk&code_challenge=xkfUye91U2rS0NWeIzhTLjpcNGh-AOiF-3A3uuHyFKI&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A14420%2Foauth%2Fcallback&state=308e5157-dfac-46ce-b13c-75a04b94a0dc&scope=offline_access&prompt=consent&resource=https%3A%2F%2Ftest-mcp.acme.com%2Fmcp-barra-models%2Fv1.0%2Fmcp

[2025-11-03T16:39:31.771Z][9572] Redirecting to authorization URL https://test-mcp.acme.com/oauth/authorize?response_type=code&client_id=87GA075d9LdzYqgYLy1vzcjWjIY4wvtk&code_challenge=xkfUye91U2rS0NWeIzhTLjpcNGh-AOiF-3A3uuHyFKI&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A14420%2Foauth%2Fcallback&state=308e5157-dfac-46ce-b13c-75a04b94a0dc&scope=offline_access&prompt=consent&resource=https%3A%2F%2Ftest-mcp.acme.com%2Fmcp-barra-models%2Fv1.0%2Fmcp
[2025-11-03T16:39:31.789Z][9572] Browser opened automatically.
[2025-11-03T16:39:31.791Z][9572] Error from remote server: {}
[2025-11-03T16:39:31.792Z][9572] Error from remote server {"stack":"Error: Unauthorized\n at StreamableHTTPClientTransport.send (file:///C:/Users/kocsszi/AppData/Local/npm-cache/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:13456:19)"}
[2025-11-03T16:39:31.793Z][9572] Error from remote server: {}
[2025-11-03T16:39:31.794Z][9572] Error from remote server {"stack":"Error: Unauthorized\n at StreamableHTTPClientTransport.send (file:///C:/Users/kocsszi/AppData/Local/npm-cache/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:13456:19)"}
[2025-11-03T16:39:31.794Z][9572] Error from remote server {"stack":"Error: Unauthorized\n at StreamableHTTPClientTransport.send (file:///C:/Users/kocsszi/AppData/Local/npm-cache/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-AKJME7CQ.js:13456:19)"}

[yaron-zehavi]

I've encountered the same issue. I've noticed 2 patterns:

• When mcp-remote starts and has existing valid tokens, the OAuth callback listener is not started and the callback port has no listener even after an authorization error is obtained and the OAuth flow begins.
• When mcp-remote has no tokens but the MCP server returns an authorization error after initialization is complete (e.g on tools/call). Also in this case the OAuth callback listener is down