{"schema_version":1,"generated_at":"2026-10-26T10:18:14Z","issues_generated_at":"2026-10-26T10:12:02Z","lookback_days":45,"license_note":"Issue metadata from public GitHub repos.","harness":"copilot-cli","issues":[{"id":"github/copilot-cli#4095","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":4095,"title":"Windows: plugin update fails with \"Access is denied (os error 5)\" while VS Code is running (Copilot extension holds watcher handles on installed-plugins)","url":"https://github.com/github/copilot-cli/issues/4095","state":"open","state_reason":null,"labels":["area:platform-windows","area:plugins"],"created":"2026-07-11T19:18:47Z","updated":"2026-09-17T10:59:18Z","closed":null,"reactions":25,"thumbs_up":25,"comments":3,"severity":"high","severity_reasons":["title:breakage"],"topic":"install/update","classes":["install/update","mcp/tools"],"cosmetic_ui":false,"summary":"copilot plugin update (and the same flow triggered from the GitHub Copilot desktop app) fails on Windows with: The git fetch/checkout of the marketplace clone succeeds every time (the clone under %LOCALAPPDATA%\\copilot\\marketplaces\\…","versions":["2.5.0","3.0.0","1.0.70","1.0.21"],"error_snippets":["Failed to update plugin: Error: Failed to install plugin: Error: Access is denied. (os error 5)","ERROR_ACCESS_DENIED (5)","Failed to install plugin: Error: Access is denied. (os error 5)","The git fetch/checkout of the marketplace clone succeeds every time (the clone under `%LOCALAPPDATA%\\copilot\\marketplaces\\...` ends up at the target commit, working tree clean). The failure happens in the final step that","Root cause (verified with a system-wide handle enumeration via `NtQuerySystemInformation(SystemExtendedHandleInformation)`): **VS Code's Copilot extension holds directory watcher handles** (access mask `0x100081`, i.e. `"],"workaround":null,"fixed_in":null,"score":151.6,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#5068","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5068,"title":"Windows: MCP Entra sign-in fails with \"this server's advertised scopes could not be safely validated for the account broker\"","url":"https://github.com/github/copilot-cli/issues/5068","state":"open","state_reason":null,"labels":["area:platform-windows","area:mcp"],"created":"2026-10-06T22:44:28Z","updated":"2026-10-12T12:38:07Z","closed":null,"reactions":12,"thumbs_up":12,"comments":3,"severity":"medium","severity_reasons":["engagement 15","class:self-host/headless","class:auth/session"],"topic":"self-host/headless","classes":["self-host/headless","auth/session","mcp/tools","crash/hang"],"cosmetic_ui":false,"summary":"On Windows, authenticating to an Entra ID–protected MCP server (Microsoft's hosted Azure DevOps MCP server, https://mcp.dev.azure.com/{org} , server type http ) fails on every fresh interactive sign-in attempt with: Authentication failed…","versions":["1.0.93-2","1.0.92","1.0.81"],"error_snippets":["On Windows, authenticating to an Entra ID–protected MCP server (Microsoft's hosted Azure DevOps MCP server, https://mcp.dev.azure.com/{org} , server type http ) fails on every fresh interactive sign-in attempt with:","Authentication failed: MCPOAuthError: Microsoft Entra sign-in for https://mcp.dev.azure.com/{org} failed: this server's advertised scopes could not be safely validated for the account broker","/mcp auth does not open the login/account-picker dialog at all — it fails immediately with the above error.","4. Expected: Windows account picker / browser OAuth dialog opens for Entra sign-in.","5. Actual: Dialog never appears; command fails instantly with the \"advertised scopes could not be safely validated for the account broker\" error."],"workaround":null,"fixed_in":null,"score":147.8,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#1305","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":1305,"title":"Support CIMD for Remote OAuth MCP Servers","url":"https://github.com/github/copilot-cli/issues/1305","state":"closed","state_reason":"completed","labels":["area:authentication","area:mcp"],"created":"2026-02-05T06:48:17Z","updated":"2026-10-19T20:11:29Z","closed":"2026-09-27T10:13:07Z","reactions":39,"thumbs_up":39,"comments":7,"severity":"medium","severity_reasons":["engagement 46","class:self-host/headless","class:auth/session"],"topic":"self-host/headless","classes":["self-host/headless","auth/session","mcp/tools"],"cosmetic_ui":false,"summary":"In 0.0.389 we added support for Remote MCP Servers protected by OAuth that support the DCR (Dynamic Client Registration) standard. DCR allows an OAuth client to register itself with an OAuth server \"just in time\" instead of requiring the…","versions":["0.0.389"],"error_snippets":["I think you, @ellismg, asked to let you know which MCP servers people are trying to use that may need this CIMD feature.","In addition to Atlassian (already mentioned), my team also uses expo, which also requires CIMD for its MCP server.","https://docs.expo.dev/mcp/"],"workaround":null,"fixed_in":null,"score":140.1,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#970","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":970,"title":"Copilot app blocked by macOS Gatekeeper under corporate security policy","url":"https://github.com/github/copilot-cli/issues/970","state":"open","state_reason":null,"labels":["area:installation"],"created":"2026-01-14T22:24:40Z","updated":"2026-10-12T15:35:04Z","closed":null,"reactions":23,"thumbs_up":23,"comments":8,"severity":"medium","severity_reasons":["engagement 31","class:install/update"],"topic":"install/update","classes":["install/update","network"],"cosmetic_ui":false,"summary":"Everytime after upgrading copilot cli through HomeBrew the following message appears: Apple could not verify “copilot” is free of malware that may harm your Mac or compromise your privacy. Afterwards, to get it working correctly, I need to…","versions":["0.0.381"],"error_snippets":["Everytime after upgrading copilot cli through HomeBrew the following message appears:","Afterwards, to get it working correctly, I need to go to Privacy & Security to explicitly allow \"copilot\"","1. On a corporate‑managed Mac with Gatekeeper enforced to App Store & Known Developers by profile."],"workaround":null,"fixed_in":null,"score":130.5,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#3100","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":3100,"title":"HTTP MCP server with Bearer token fails OAuth discovery instead of falling back to headers auth","url":"https://github.com/github/copilot-cli/issues/3100","state":"open","state_reason":null,"labels":["area:authentication","area:mcp"],"created":"2026-05-04T07:20:56Z","updated":"2026-10-16T15:21:31Z","closed":null,"reactions":11,"thumbs_up":11,"comments":2,"severity":"medium","severity_reasons":["class:self-host/headless","class:auth/session"],"topic":"self-host/headless","classes":["self-host/headless","auth/session","mcp/tools","network"],"cosmetic_ui":false,"summary":"When an HTTP MCP server is configured in .mcp.json with \"type\": \"http\" and \"headers\": { \"Authorization\": \"Bearer \" }, the CLI attempts OAuth discovery (/.well-known/oauth-authorization-server ) and fails with: MCPOAuthError: Failed to…","versions":[],"error_snippets":["MCPOAuthError: Failed to discover authorization server metadata","The CLI does not fall back to using the provided Bearer token from headers, causing a hard auth failure even though valid credentials are present in the config.","4. Pay attention to the error","Expected behavior: If OAuth discovery fails and headers contains Authorization: Bearer, the CLI should skip OAuth and proceed to MCP initialize using the provided token.","Workaround: Manually enabling the server via /mcp enable bypasses OAuth discovery and connects successfully using the Bearer token."],"workaround":{"text":"Manually enabling the server via /mcp enable bypasses OAuth discovery and connects successfully using the Bearer token.","source":"issue body","url":"https://github.com/github/copilot-cli/issues/3100"},"fixed_in":null,"score":129.0,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#4851","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":4851,"title":"Azure MCP server fails sending HTTP request","url":"https://github.com/github/copilot-cli/issues/4851","state":"open","state_reason":null,"labels":["triage"],"created":"2026-09-15T09:40:38Z","updated":"2026-10-01T21:31:12Z","closed":null,"reactions":10,"thumbs_up":10,"comments":5,"severity":"medium","severity_reasons":["engagement 15","class:self-host/headless","class:mcp/tools"],"topic":"self-host/headless","classes":["self-host/headless","mcp/tools","network"],"cosmetic_ui":false,"summary":"This broke overnight. We've been using the same Azure MCP registry for months fine. Copilot CLI Rust runtime fails with BrokenPipe when validating Azure API Center MCP registry. GitHub Copilot CLI 1.0.83 cannot validate MCP servers against…","versions":["1.0.83","1.2","1.1","0.13.4"],"error_snippets":["[rust:hyper_util::client::legacy::connect::http] connected to ...:443","[rust:hyper_util::client::legacy::client] client connection error:","hyper::Error(Shutdown, Os {","Failed to load registry: Error: HTTP request failed: error sending request for url ( <redacted> )","GitHub Copilot CLI 1.0.83 cannot validate MCP servers against an Azure API Center registry when enterprise MCP access is configured as Registry only."],"workaround":null,"fixed_in":null,"score":110.2,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#5197","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5197,"title":"Voice server segfaults (signal 11) on WSL2 after updating to 1.0.100; /voice stuck on 'Fetching voice models'","url":"https://github.com/github/copilot-cli/issues/5197","state":"open","state_reason":null,"labels":["area:input-keyboard"],"created":"2026-10-19T22:28:49Z","updated":"2026-10-22T21:59:08Z","closed":null,"reactions":2,"thumbs_up":2,"comments":4,"severity":"medium","severity_reasons":["class:self-host/headless","class:install/update"],"topic":"self-host/headless","classes":["self-host/headless","install/update","crash/hang","network"],"cosmetic_ui":false,"summary":"After updating to Copilot CLI 1.0.100 (which also pulled a new voice runtime), voice input no longer works on WSL2. The voice server process segfaults (signal 11) a few seconds after starting, so /voice stays on \"Fetching voice models\" and…","versions":["1.0.100","1.0.98"],"error_snippets":["[INFO] voice server: boot pid=1708 endpoint=/run/user/1000/copilot-voice/<id>.sock","[WARNING] [VoiceEngine] connection error: read ECONNRESET","[ERROR] [VoiceEngine] fatal: Engine connection closed.","[WARNING] [VoiceEngine] start failed: Engine connection closed.","copilot: MainThread: potentially unexpected fatal signal 11."],"workaround":null,"fixed_in":null,"score":106.5,"first_seen":"2026-10-20T09:28:14Z"},{"id":"github/copilot-cli#1803","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":1803,"title":"Support MCP resources/read primitive","url":"https://github.com/github/copilot-cli/issues/1803","state":"open","state_reason":null,"labels":["area:mcp"],"created":"2026-03-03T13:57:56Z","updated":"2026-10-05T16:17:01Z","closed":null,"reactions":14,"thumbs_up":14,"comments":2,"severity":"medium","severity_reasons":["engagement 16","class:mcp/tools"],"topic":"mcp/tools","classes":["mcp/tools","self-host/headless","auth/session"],"cosmetic_ui":false,"summary":"MCP servers can expose data through the resources primitive (resources/list, resources/read). This is one of the three core MCP primitives alongside tools and prompts. Currently, Copilot CLI only supports MCP tools. When an MCP tool…","versions":["2.2.2"],"error_snippets":["✓ search_topics: pekko kafka consumer actor ordering sharding entity","└ Found 5 results for \"pekko kafka consumer actor ordering sharding entity\":","TypeError: fetch failed","MCP servers can expose data through the `resources` primitive (`resources/list`, `resources/read`). This is one of the three core MCP primitives alongside tools and prompts."],"workaround":null,"fixed_in":null,"score":104.0,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#4905","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":4905,"title":"Desktop app: sessions die minutes after spawn — \"GitHub credential registration is no longer available for this session\" makes the github-mcp-server catalog stale and fatal","url":"https://github.com/github/copilot-cli/issues/4905","state":"open","state_reason":null,"labels":["triage"],"created":"2026-09-18T20:03:30Z","updated":"2026-09-27T17:44:04Z","closed":null,"reactions":4,"thumbs_up":4,"comments":6,"severity":"critical","severity_reasons":["title:data-loss/security"],"topic":"self-host/headless","classes":["self-host/headless","auth/session","mcp/tools","always-on/daemon"],"cosmetic_ui":false,"summary":"GitHub Copilot desktop app 1.1.22 (commit c3daa01), macOS arm64, bundled CLI 1.0.84-5 (server mode, stdio, Rust JSON-RPC engine) Single github.com account signed in to the app; gh auth status (bundled gh 2.98.0, using the app-exported…","versions":["1.1.22","1.0.84-5","2.98.0","1.0.86"],"error_snippets":["MCP tool catalog changed before tool \"github-mcp-server-web_search\" could be invoked: Failed to verify cached MCP tools: MCP request failed: Transport send error: unexpected server response: dynamic header provider faile","Execution failed: Failed to refresh MCP tools for server github-mcp-server; the last catalog is stale","[WARNING] [rust:remote::api_session_exporter] remote session batch flush failed {\"error\":\"GitHub credential authority error: GitHub token provider registration \\\"<per-process uuid>\\\" is unavailable\", …}","2.98.0, using the app-exported","session.end reason: error"],"workaround":null,"fixed_in":null,"score":98.5,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#4998","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":4998,"title":"Copilot CLI unusable after macOS update/reboot because `.mcp-writer.binding` persists stale filesystem device ID","url":"https://github.com/github/copilot-cli/issues/4998","state":"closed","state_reason":"completed","labels":["area:mcp"],"created":"2026-09-29T17:31:31Z","updated":"2026-10-16T13:12:33Z","closed":"2026-10-08T10:11:09Z","reactions":11,"thumbs_up":11,"comments":11,"severity":"high","severity_reasons":["title:breakage"],"topic":"install/update","classes":["install/update","mcp/tools","always-on/daemon","self-host/headless","crash/hang"],"cosmetic_ui":false,"summary":"Immediately after installing the latest macOS security update and rebooting, all Copilot CLI sessions—both newly started sessions and resumed existing sessions—became unable to process prompts. GitHub Copilot CLI 1.0.90-3. macOS Golden…","versions":["1.0.90-3.","27.0.1","1.0.90-3"],"error_snippets":["Failed to start MCP Servers: Error: The shared writer lock or its directory changed.","Scheduled queue processing failed; retrying once {\"error\":\"Message(\\\"The shared writer lock or its directory changed.\\\")\"}","Scheduled queue processing failed after retry; queue drain abandoned {\"error\":\"Message(\\\"The shared writer lock or its directory changed.\\\")\"}","Failed to start MCP Servers: Error: Shared writer storage I/O failed.","Request session.send failed with message: Shared writer storage I/O failed."],"workaround":null,"fixed_in":null,"score":82.6,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#4870","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":4870,"title":"MCP: Figma remote server (mcp.figma.com) fails to load — `-32601` on `server/discover` treated as fatal (works in VS Code)","url":"https://github.com/github/copilot-cli/issues/4870","state":"closed","state_reason":"completed","labels":[],"created":"2026-09-16T08:51:26Z","updated":"2026-09-29T12:57:06Z","closed":"2026-09-20T18:33:29Z","reactions":12,"thumbs_up":12,"comments":8,"severity":"medium","severity_reasons":["engagement 20","class:self-host/headless","class:mcp/tools"],"topic":"self-host/headless","classes":["self-host/headless","mcp/tools","always-on/daemon","install/update","crash/hang","auth/session"],"cosmetic_ui":false,"summary":"The Figma hosted MCP server (https://mcp.figma.com/mcp) authenticates and initializes successfully, but the CLI never registers its tools. The CLI's discovery probe receives -32601 Method not found, records it as a fatal server failure…","versions":["1.0.85"],"error_snippets":["[DEBUG] rt_mcp::native_host: Recorded failure for server figma: MCP error -32601: Method not found.","[WARNING] copilot_runtime::session::mcp::agent_host: MCP error -32601: Method not found. { server: \"figma\" }","[ERROR] rmcp::transport::worker: worker quit with fatal: Transport channel closed,","when Client(OAuthChallenge { ... mcp.figma.com ... status_code: 401 })","-32601 Method not found"],"workaround":{"text":"Update to a newer CLI build that supports Figma's `2026-07-28` MCP protocol handshake.","source":"issue body","url":"https://github.com/github/copilot-cli/issues/4870"},"fixed_in":null,"score":79.0,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#5192","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5192,"title":"ACP mode: MCP OAuth token is never persisted after successful sign-in — every new session re-opens the browser","url":"https://github.com/github/copilot-cli/issues/5192","state":"open","state_reason":null,"labels":["area:non-interactive","area:mcp"],"created":"2026-10-19T15:49:22Z","updated":"2026-10-21T13:01:30Z","closed":null,"reactions":1,"thumbs_up":1,"comments":2,"severity":"medium","severity_reasons":["class:auth/session","class:mcp/tools"],"topic":"auth/session","classes":["auth/session","mcp/tools","always-on/daemon","self-host/headless","install/update"],"cosmetic_ui":false,"summary":"In ACP mode (copilot --acp), the OAuth token for a remote HTTP MCP server is never written to disk or the OS keychain after a successful sign-in. Each new ACP session (for example, each new thread in an ACP client) starts unauthenticated…","versions":["1.0.98"],"error_snippets":["14:32:47.302Z [WARNING] [rust:copilot_runtime::session::mcp::agent_host] HTTP 401 challenge (...) {\"server\":\"atlassian-cloud\"}","15:22:30Z [WARNING] [rust:copilot_runtime::session::mcp::agent_host] HTTP 401 challenge (...) {\"server\":\"atlassian-cloud\"}","15:23:48Z ... timed out after 60s","In ACP mode (`copilot --acp`), the OAuth token for a remote HTTP MCP server is never written to disk or the OS keychain after a successful sign-in. Each new ACP session (for example, each new thread in an ACP client) sta","Evidence from a successful sign-in (macOS, Atlassian remote MCP `https://mcp.atlassian.com/v2/mcp`):"],"workaround":null,"fixed_in":null,"score":76.5,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#5253","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5253,"title":"CLI 1.0.103: persistent session-lock timeouts and unresponsive tasks amid host event acknowledgement failures","url":"https://github.com/github/copilot-cli/issues/5253","state":"open","state_reason":null,"labels":["area:sessions","area:agents"],"created":"2026-10-25T15:55:58Z","updated":"2026-10-26T05:29:08Z","closed":null,"reactions":0,"thumbs_up":0,"comments":2,"severity":"medium","severity_reasons":["class:crash/hang","class:network"],"topic":"crash/hang","classes":["crash/hang","network","install/update"],"cosmetic_ui":false,"summary":"A long-lived Copilot CLI session becomes largely unresponsive. Opening/refreshing tasks shows: The process stays alive, and some nested tool activity continues, but the UI/event reader repeatedly fails to acquire the session lock. macOS…","versions":["1.0.103","1.0.96","25.472","51.503"],"error_snippets":["Failed to refresh tasks: Error: session lock unavailable during is_session_generation_current: acquisition timed out","process-1792833427506-51062.1.log:L1 2026-10-25T13:48:30.453Z [WARNING] [rust:copilot_runtime::session::pending_request_flow] pending-request event was not delivered to the session host {\"error\": \"GenericFailure, session","process-1792833427506-51062.1.log:L39 2026-10-25T13:48:30.777Z [ERROR] SessionClient poll loop error (will retry): Error: session lock unavailable during is_session_generation_current: acquisition timed out","process-1792833427506-51062.1.log:L41 2026-10-25T13:48:31.076Z [WARNING] [rust:otel] dropping OTel tool facts: pending call limit exceeded","process-1792833427506-51062.1.log:L47 2026-10-25T13:48:31.091Z [WARNING] [rust:events_engine::host_delivery] event was not delivered to its registered session host {\"error\": \"GenericFailure, session event delivery failed"],"workaround":null,"fixed_in":null,"score":75.2,"first_seen":"2026-10-26T10:12:02Z"},{"id":"github/copilot-cli#4935","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":4935,"title":"Built-in Slack MCP integration requests full scope superset even when only read tools are exposed","url":"https://github.com/github/copilot-cli/issues/4935","state":"open","state_reason":null,"labels":["area:mcp"],"created":"2026-09-22T12:51:56Z","updated":"2026-10-26T05:28:48Z","closed":null,"reactions":5,"thumbs_up":4,"comments":1,"severity":"medium","severity_reasons":["class:mcp/tools"],"topic":"mcp/tools","classes":["mcp/tools","self-host/headless","auth/session"],"cosmetic_ui":false,"summary":"When authenticating the built-in Slack MCP server ( mcp.slack.com ) via Copilot CLI, the generated OAuth consent URL requests the full superset of Slack scopes — including write scopes ( chat:write , files:write , channels:write …","versions":["1.0.87-0"],"error_snippets":["When authenticating the built-in Slack MCP server ( mcp.slack.com ) via Copilot CLI, the generated OAuth consent URL requests the full superset of Slack scopes — including write scopes ( chat:write , files:write , channe","Example generated authorize URL (redacted):","Expected behavior","Users are asked to grant far broader permissions (including message sending, file uploads, channel creation, list/canvas writes) than the tool set they can actually use, violating least-privilege expectations.","1. Ensure the built-in Slack MCP server ( mcp.slack.com ) is available in Copilot CLI (no custom config needed — it's a first-party integration)."],"workaround":null,"fixed_in":null,"score":75.0,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#4994","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":4994,"title":"Regression (1.0.88 → 1.0.89): MCP OAuth authorization page opens on every ACP session instead of the challenge being resolved silently","url":"https://github.com/github/copilot-cli/issues/4994","state":"open","state_reason":null,"labels":["area:non-interactive","area:mcp"],"created":"2026-09-29T10:12:55Z","updated":"2026-10-19T15:30:53Z","closed":null,"reactions":2,"thumbs_up":2,"comments":2,"severity":"high","severity_reasons":["title:breakage"],"topic":"install/update","classes":["install/update","auth/session","mcp/tools","self-host/headless"],"cosmetic_ui":false,"summary":"An OAuth-protected HTTP MCP server that has a valid, unexpired access token in ~/.copilot/mcp-oauth-config is answered with HTTP 401 on every new --acp session, and the CLI responds by opening the OAuth authorization page again. Because…","versions":["1.0.88","1.0.89","152.1","1.0.80"],"error_snippets":["[ERROR] [rust:rmcp::transport::worker] worker quit with fatal: Transport channel closed,","www_authenticate_header: \"******\\\"https://mcp.internal.example.com/.well-known/oauth-protected-resource/servers/REDACTED-MCP/mcp\\\"\",","response: McpOAuthHttpResponse { status_code: 401, header_count: 6, has_body: true } })","[WARNING] [rust:copilot_runtime::session::mcp::agent_host] HTTP 401 challenge","(WWW-Authenticate: ******\"https://mcp.internal.example.com/.well-known/oauth-protected-resource/servers/REDACTED-MCP/mcp\")"],"workaround":null,"fixed_in":null,"score":70.5,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#4929","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":4929,"title":"Process-local auth token stops refreshing; all prompts fail until restart","url":"https://github.com/github/copilot-cli/issues/4929","state":"open","state_reason":null,"labels":["triage"],"created":"2026-09-22T05:49:46Z","updated":"2026-09-28T18:19:33Z","closed":null,"reactions":0,"thumbs_up":0,"comments":13,"severity":"medium","severity_reasons":["class:auth/session"],"topic":"auth/session","classes":["auth/session","install/update","mcp/tools","network"],"cosmetic_ui":false,"summary":"A long-running Copilot CLI process permanently loses authentication. After the failure, every normal prompt and /ask immediately returns an authorization error. Running /login does not recover the process. Restarting and resuming the same…","versions":["1.0.85"],"error_snippets":["A long-running Copilot CLI process permanently loses authentication. After the failure, every normal prompt and /ask immediately returns an authorization error. Running /login does not recover the process. Restarting and","The failure is process-local: several older concurrent CLI processes remained usable, and a newly launched process authenticated successfully. No COPILOT_GITHUB_TOKEN, GH_TOKEN, or GITHUB_TOKEN override was present.","The failing process first logged an expired/rejected GitHub MCP token almost exactly one hour after startup. It later logged 401 AuthenticateToken failed from the Copilot Tasks API. OAuth recovery attempted discovery aga","4. Observe that every prompt and /ask reports an authorization error.","7. Restart/resume the failed process; observe that authentication works again."],"workaround":null,"fixed_in":null,"score":68.4,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#4847","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":4847,"title":"Automatic managed-settings refresh breaks IDE MCP reload and disables /allow-all","url":"https://github.com/github/copilot-cli/issues/4847","state":"open","state_reason":null,"labels":["triage"],"created":"2026-09-15T02:45:45Z","updated":"2026-09-23T14:42:32Z","closed":null,"reactions":4,"thumbs_up":4,"comments":4,"severity":"medium","severity_reasons":["class:mcp/tools"],"topic":"mcp/tools","classes":["mcp/tools","self-host/headless","install/update","network"],"cosmetic_ui":false,"summary":"In a long-running Copilot CLI session connected to Visual Studio Code, an automatic managed-settings refresh can fail while reloading the dynamically contributed IDE MCP server: After this failure, the session enters a fail-closed…","versions":["1.0.84-6","1.0.84-8","7.6.6"],"error_snippets":["Failed to enforce managed Computer Use policy: failed to reload Computer Use","MCP reload failed: mcpServers.ide.type: Invalid literal value","[managedSettings] effective policy resolved:","source=mdm, bypassDisabled=false, serverFetchFailed=false","[managedSettings] self-fetch errored:"],"workaround":null,"fixed_in":null,"score":65.8,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#5236","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5236,"title":"Windows: Entra broker token cache stays 0 bytes after MCP sign-in, so every new process re-prompts","url":"https://github.com/github/copilot-cli/issues/5236","state":"open","state_reason":null,"labels":["area:platform-windows","area:mcp"],"created":"2026-10-22T18:48:08Z","updated":"2026-10-25T18:57:55Z","closed":null,"reactions":0,"thumbs_up":0,"comments":1,"severity":"medium","severity_reasons":["class:auth/session","class:mcp/tools"],"topic":"auth/session","classes":["auth/session","mcp/tools","self-host/headless"],"cosmetic_ui":false,"summary":"After I sign in through the Microsoft Entra account broker for an HTTP MCP server, the token cache file stays empty. Every new process shows the account picker again. A /restart in the same process does not prompt…","versions":["1.0.103"],"error_snippets":["~\\.copilot\\entra-broker-accounts\\<id>.bin","~\\.copilot\\entra-broker-cache\\<id>.bin","{\"mcpServers\": {\"EngHub\": {\"type\": \"http\", \"url\": \"https://mcp.eng.ms\", \"tools\": [\"*\"]}}}","Authenticating: EngHub","~\\.copilot\\entra-broker-cache\\"],"workaround":null,"fixed_in":null,"score":63.0,"first_seen":"2026-10-23T09:23:24Z"},{"id":"github/copilot-cli#5222","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5222,"title":"Startup reports disabled MCP servers as “blocked by policy” and repeats the warnings","url":"https://github.com/github/copilot-cli/issues/5222","state":"open","state_reason":null,"labels":["area:mcp"],"created":"2026-10-21T19:45:45Z","updated":"2026-10-22T05:25:56Z","closed":null,"reactions":1,"thumbs_up":1,"comments":0,"severity":"medium","severity_reasons":["class:self-host/headless","class:mcp/tools"],"topic":"self-host/headless","classes":["self-host/headless","mcp/tools"],"cosmetic_ui":false,"summary":"Copilot CLI displays organization-policy warnings at startup even though every configured third-party MCP server is explicitly disabled through disabledMcpServers in the user settings. The same pair of warnings appears twice during…","versions":["1.0.101"],"error_snippets":["Copilot CLI displays organization-policy warnings at startup even though every configured third-party MCP server is explicitly disabled through `disabledMcpServers` in the user settings. The same pair of warnings appears","Both messages appear twice in the observed startup. Every server named in the warning is already explicitly disabled in the user settings.","These observations explain the reporting behavior; **they do not establish that disabled servers are launched**. The exact trigger for the second initialization/reload has not been identified."],"workaround":null,"fixed_in":null,"score":61.4,"first_seen":"2026-10-26T10:12:02Z"},{"id":"github/copilot-cli#5223","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5223,"title":"Interactive autopilot stops after 600s while a background subagent is still running (regression in 1.0.102)","url":"https://github.com/github/copilot-cli/issues/5223","state":"open","state_reason":null,"labels":["area:agents"],"created":"2026-10-21T21:43:57Z","updated":"2026-10-23T23:08:36Z","closed":null,"reactions":0,"thumbs_up":0,"comments":1,"severity":"high","severity_reasons":["title:breakage"],"topic":"always-on/daemon","classes":["always-on/daemon","install/update","crash/hang","network"],"cosmetic_ui":false,"summary":"Since 1.0.102, interactive autopilot stops whenever a background subagent runs for more than 600 seconds. The subagent is still working normally when this happens. The CLI shows: A common pattern is for the main agent to start a background…","versions":["1.0.102","1.0.101","1.0.80"],"error_snippets":["COPILOT_TASK_WAIT_TIMEOUT_SECONDS","autopilot_background_timeout","export COPILOT_TASK_WAIT_TIMEOUT_SECONDS=3600","COPILOT_TASK_WAIT_TIMEOUT_SECONDS=0","> Autopilot stopped after 600s waiting for background tasks. Set COPILOT_TASK_WAIT_TIMEOUT_SECONDS to change the limit."],"workaround":{"text":"In 1.0.102 the native runtime adds new autopilot continuation logic, and the stop message and `autopilot_background_timeout` warning first appear there. - Workaround: `export COPILOT_TASK_WAIT_TIMEOUT_SECONDS=3600` (or higher) before launching. - The limit can't be turned off.","source":"issue body","url":"https://github.com/github/copilot-cli/issues/5223"},"fixed_in":null,"score":59.3,"first_seen":"2026-10-24T08:54:58Z"},{"id":"github/copilot-cli#1838","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":1838,"title":"Bug: Copilot CLI hangs in Nix/direnv environments due to subprocess I/O deadlock","url":"https://github.com/github/copilot-cli/issues/1838","state":"closed","state_reason":"completed","labels":["area:tools"],"created":"2026-03-05T06:17:46Z","updated":"2026-09-28T10:29:28Z","closed":"2026-09-28T10:29:28Z","reactions":12,"thumbs_up":12,"comments":7,"severity":"high","severity_reasons":["title:breakage"],"topic":"crash/hang","classes":["crash/hang","network"],"cosmetic_ui":false,"summary":"Copilot CLI v0.0.421 hangs indefinitely when launched from directories with Nix flake-based development environments managed by direnv. The bash tool fails to execute any commands, timing out with Invalid shell ID errors. Analysis of the…","versions":["0.0.421"],"error_snippets":["# Create a minimal flake-based dev environment","# Create flake.nix with direnv-managed environment","flake-utils.lib.eachDefaultSystem (system:","# Create .envrc","cat > .envrc << 'ENVRC'"],"workaround":null,"fixed_in":null,"score":59.3,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#5088","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5088,"title":"Windows: CLI crashes (0xc0000005 in msalruntime.dll) on first Entra account-broker sign-in for MCP server - interactive WAM called with no parent window","url":"https://github.com/github/copilot-cli/issues/5088","state":"open","state_reason":null,"labels":["area:authentication","area:platform-windows","area:mcp"],"created":"2026-10-08T17:28:39Z","updated":"2026-10-12T09:51:38Z","closed":null,"reactions":1,"thumbs_up":1,"comments":1,"severity":"high","severity_reasons":["title:breakage"],"topic":"self-host/headless","classes":["self-host/headless","crash/hang","auth/session","mcp/tools","install/update"],"cosmetic_ui":false,"summary":"On Windows, the first Microsoft Entra account broker (WAM) sign-in for a remote MCP server on the built-in Entra fast-path list (here https://sentinel.microsoft.com/mcp/data-exploration) hard-crashes the CLI process with an access…","versions":["1.0.91","1.0.94-4","2.0"],"error_snippets":["\"Microsoft Sentinel Data Exploration\": { \"type\": \"http\", \"url\": \"https://sentinel.microsoft.com/mcp/data-exploration\", \"tools\": [\"*\"] }","[ERROR] Connecting to Microsoft Sentinel Data Exploration...","[ERROR] Signing in with your Microsoft Entra account (account broker)...","Exception code: 0xc0000005","https://sentinel.microsoft.com/mcp/data-exploration"],"workaround":null,"fixed_in":null,"score":58.6,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#5134","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5134,"title":"Windows: runaway MCP OAuth initialization opens repeated browser sessions; Maximum update depth exceeded","url":"https://github.com/github/copilot-cli/issues/5134","state":"open","state_reason":null,"labels":["area:mcp"],"created":"2026-10-13T18:20:28Z","updated":"2026-10-14T05:25:00Z","closed":null,"reactions":1,"thumbs_up":1,"comments":0,"severity":"medium","severity_reasons":["class:install/update","class:auth/session"],"topic":"install/update","classes":["install/update","auth/session","mcp/tools","self-host/headless"],"cosmetic_ui":false,"summary":"Running copilot interactively on Windows causes repeated OAuth browser sessions during initialization. Browser sessions keep opening until the user terminates Copilot. This prevents normal startup and authentication. Existing CLI logs…","versions":["1.0.60"],"error_snippets":["\"url\": \"https://mcp.expo.dev/mcp\",","2026-10-13T18:16:02.994Z [ERROR] Server supabase-staging requires authentication, initiating OAuth flow","2026-10-13T18:16:03.071Z [ERROR] Server supabase-staging requires authentication, initiating OAuth flow","2026-10-13T18:16:03.094Z [ERROR] Server supabase-staging requires authentication, initiating OAuth flow","2026-10-13T18:16:03.099Z [ERROR] Server supabase-staging requires authentication, initiating OAuth flow"],"workaround":null,"fixed_in":null,"score":55.2,"first_seen":"2026-10-22T09:27:06Z"},{"id":"github/copilot-cli#5124","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5124,"title":"`--agent <name>` selection is dropped ~1s after startup (race with sign-in / MCP reload)","url":"https://github.com/github/copilot-cli/issues/5124","state":"open","state_reason":null,"labels":["area:agents"],"created":"2026-10-12T15:17:03Z","updated":"2026-10-20T11:08:50Z","closed":null,"reactions":0,"thumbs_up":0,"comments":2,"severity":"medium","severity_reasons":["class:auth/session","class:mcp/tools"],"topic":"auth/session","classes":["auth/session","mcp/tools","always-on/daemon","self-host/headless"],"cosmetic_ui":false,"summary":"When starting the CLI with --agent , the custom agent is selected and then silently deselected ~1 s later, before any user input. The banner shows Selected custom agent: my-agent, then MCP Servers reloaded: 1 server connected, and the…","versions":["11.603","11.765","11.717","12.400"],"error_snippets":["14:59:12.400 subagent.deselected {}","events.jsonl","Failed to start MCP Servers: session not found","It looks like a race between the startup agent selection and the agent/MCP refresh after sign-in. `events.jsonl` of an affected session (no user input in between):","4. Agent is gone from the status bar; `events.jsonl` shows `subagent.deselected`."],"workaround":{"text":"Frequency (automated pty launches, no input, 15 s each): dropped 5/6 with a user-level agent (`--agent my-agent`), 4/6 with a plugin agent (`--agent myplugin:my-agent`). - When MCP startup failed (`Failed to start MCP Servers: session not found`), the agent was never dropped, which points to the…","source":"issue body","url":"https://github.com/github/copilot-cli/issues/5124"},"fixed_in":null,"score":53.9,"first_seen":"2026-10-21T09:24:21Z"},{"id":"github/copilot-cli#3682","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":3682,"title":"Support refreshing the BYOK provider credential without restarting the CLI","url":"https://github.com/github/copilot-cli/issues/3682","state":"closed","state_reason":"completed","labels":["area:authentication","area:models"],"created":"2026-06-04T21:57:27Z","updated":"2026-09-29T08:25:57Z","closed":"2026-09-24T10:11:21Z","reactions":9,"thumbs_up":9,"comments":4,"severity":"critical","severity_reasons":["title:data-loss/security"],"topic":"auth/session","classes":["auth/session","always-on/daemon","network"],"cosmetic_ui":false,"summary":"When using a BYOK provider with a short-lived bearer credential (e.g. an Entra ID / Azure AD OAuth access token, an AWS STS token, or any OIDC JWT), the Copilot CLI reads COPILOTPROVIDERAPIKEY (and any custom headers) once at process…","versions":[],"error_snippets":["When using a BYOK provider with a short-lived bearer credential (e.g. an Entra ID / Azure AD OAuth access token, an AWS STS token, or any OIDC JWT), the Copilot CLI reads COPILOT_PROVIDER_API_KEY (and any custom headers)","Entra access tokens live ~60–90 minutes. In a long interactive coding session the token expires mid-conversation, the upstream gateway (e.g. Azure API Management running validate-jwt) starts returning HTTP 401, and the C","This forces BYOK deployments that want true per-user identity (rather than a long-lived static API key) to run an external local reverse-proxy sidecar purely to re-mint and inject a fresh token on each request. That side","Provide a way for the CLI to obtain a fresh credential per request (or on 401), e.g. one of:","File-backed credential. COPILOT_PROVIDER_API_KEY_FILE=/path/to/token where the CLI re-reads the file per request (an external az/cron/sidecar keeps it fresh). Simpler but weaker than option 1."],"workaround":{"text":"export COPILOT_PROVIDER_TYPE=azure export COPILOT_PROVIDER_BASE_URL=https://my-apim.azure-api.us/openai export COPILOT_MODEL=gpt-5.1 ### CLI runs this to get a token, and re-runs it automatically before expiry / on 401: export COPILOT_PROVIDER_API_KEY_COMMAND='az account get-access-token --scope…","source":"issue body","url":"https://github.com/github/copilot-cli/issues/3682"},"fixed_in":null,"score":53.4,"first_seen":"2026-10-23T09:23:24Z"},{"id":"github/copilot-cli#5185","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5185,"title":"P3 - container-runtime/copilot-runtime-bazel-cache-memory-usage-vs-limits-dotcom on catalog_service:copilot-runtime-bazel-cache,kube_cluster:dotcom-3-gc-cus-02,kube_container_name:copilot-runtime-bazel-cache,kube_deployment:copilot-r... - 2026-10-18T14:11Z","url":"https://github.com/github/copilot-cli/issues/5185","state":"open","state_reason":null,"labels":["source:datadog","catalog_service:copilot-runtime-bazel-cache","CRITICAL"],"created":"2026-10-18T14:12:15Z","updated":"2026-10-22T07:04:32Z","closed":null,"reactions":0,"thumbs_up":0,"comments":1,"severity":"critical","severity_reasons":["label:critical"],"topic":"always-on/daemon","classes":["always-on/daemon","self-host/headless","crash/hang"],"cosmetic_ui":false,"summary":"Source: [[P3] [Triggered] container-runtime/copilot-runtime-bazel-cache-memory-usage-vs-limits-dotcom on…","versions":["95.906"],"error_snippets":["Container `copilot-runtime-bazel-cache` in deployment `copilot-runtime-bazel-cache` (namespace `copilot-runtime-bazel-cache-production`, service `copilot-runtime-bazel-cache`) in cluster `dotcom-3-gc-cus-02` — its busies","3. If this is expected, right-size the memory request/limit; otherwise escalate to the service owner.","1. Pick ONE of the following exclusions:","[Monitor Status] · [Edit Monitor] · [Related Logs]"],"workaround":null,"fixed_in":null,"score":51.0,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#5170","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5170,"title":"P3 - container-runtime/copilot-runtime-bazel-cache-memory-usage-vs-limits-dotcom on catalog_service:copilot-runtime-bazel-cache,kube_cluster:dotcom-2-gc-cus-02,kube_container_name:copilot-runtime-bazel-cache,kube_deployment:copilot-r... - 2026-10-16T17:35Z","url":"https://github.com/github/copilot-cli/issues/5170","state":"open","state_reason":null,"labels":["source:datadog","catalog_service:copilot-runtime-bazel-cache","CRITICAL"],"created":"2026-10-16T17:36:15Z","updated":"2026-10-22T07:04:29Z","closed":null,"reactions":0,"thumbs_up":0,"comments":1,"severity":"critical","severity_reasons":["label:critical"],"topic":"always-on/daemon","classes":["always-on/daemon","self-host/headless","crash/hang"],"cosmetic_ui":false,"summary":"Source: [[P3] [Triggered] container-runtime/copilot-runtime-bazel-cache-memory-usage-vs-limits-dotcom on…","versions":["95.955"],"error_snippets":["Container `copilot-runtime-bazel-cache` in deployment `copilot-runtime-bazel-cache` (namespace `copilot-runtime-bazel-cache-production`, service `copilot-runtime-bazel-cache`) in cluster `dotcom-2-gc-cus-02` — its busies","3. If this is expected, right-size the memory request/limit; otherwise escalate to the service owner.","1. Pick ONE of the following exclusions:","[Monitor Status] · [Edit Monitor] · [Related Logs]"],"workaround":null,"fixed_in":null,"score":49.0,"first_seen":"2026-10-22T09:27:06Z"},{"id":"github/copilot-cli#5169","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5169,"title":"P3 - container-runtime/copilot-runtime-bazel-cache-memory-usage-vs-limits-dotcom on catalog_service:copilot-runtime-bazel-cache,kube_cluster:dotcom-1-gc-cus-02,kube_container_name:copilot-runtime-bazel-cache,kube_deployment:copilot-r... - 2026-10-16T17:32Z","url":"https://github.com/github/copilot-cli/issues/5169","state":"open","state_reason":null,"labels":["source:datadog","catalog_service:copilot-runtime-bazel-cache","CRITICAL"],"created":"2026-10-16T17:33:16Z","updated":"2026-10-22T07:04:23Z","closed":null,"reactions":0,"thumbs_up":0,"comments":1,"severity":"critical","severity_reasons":["label:critical"],"topic":"always-on/daemon","classes":["always-on/daemon","self-host/headless","crash/hang"],"cosmetic_ui":false,"summary":"Source: [[P3] [Triggered] container-runtime/copilot-runtime-bazel-cache-memory-usage-vs-limits-dotcom on…","versions":["96.507"],"error_snippets":["Container `copilot-runtime-bazel-cache` in deployment `copilot-runtime-bazel-cache` (namespace `copilot-runtime-bazel-cache-production`, service `copilot-runtime-bazel-cache`) in cluster `dotcom-1-gc-cus-02` — its busies","3. If this is expected, right-size the memory request/limit; otherwise escalate to the service owner.","1. Pick ONE of the following exclusions:","[Monitor Status] · [Edit Monitor] · [Related Logs]"],"workaround":null,"fixed_in":null,"score":49.0,"first_seen":"2026-10-22T09:27:06Z"},{"id":"github/copilot-cli#5066","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5066,"title":"Assisted permissions regression","url":"https://github.com/github/copilot-cli/issues/5066","state":"open","state_reason":null,"labels":["area:permissions"],"created":"2026-10-06T18:01:33Z","updated":"2026-10-07T05:28:16Z","closed":null,"reactions":1,"thumbs_up":1,"comments":3,"severity":"high","severity_reasons":["title:breakage"],"topic":"install/update","classes":["install/update"],"cosmetic_ui":false,"summary":"Recently assisted permissions mode has been requiring my approval for too many commands. This is mostly just a feeling that something has changed so sorry for being vague, but for example this powershell command to find files in the…","versions":[],"error_snippets":["Get-ChildItem -Recurse -Depth 3 -Filter *.?sproj | Where-Object { $_.Name -match 'web|manage' } | Select-Object -Expand FullName; Get-ChildItem -Directory | Select-Object -Expand Name","Recently assisted permissions mode has been requiring my approval for too many commands. This is mostly just a feeling that something has changed so sorry for being vague, but for example this powershell command to find ","Along with other commands to build and run the project when I explicitly asked for the project to be built and ran"],"workaround":null,"fixed_in":null,"score":48.0,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#4910","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":4910,"title":"Non-interactive MCP tool call hangs after progress notification until idle timeout","url":"https://github.com/github/copilot-cli/issues/4910","state":"open","state_reason":null,"labels":["triage"],"created":"2026-09-19T18:43:00Z","updated":"2026-09-20T03:50:39Z","closed":null,"reactions":0,"thumbs_up":0,"comments":3,"severity":"high","severity_reasons":["title:breakage"],"topic":"crash/hang","classes":["crash/hang","mcp/tools","network","always-on/daemon","self-host/headless"],"cosmetic_ui":false,"summary":"In non-interactive Copilot CLI, an already-discovered Azure MCP tool call can hang after delivering its initial progress notification. No tool result is delivered, and the MCP WebSocket closes five minutes later with idle timeout. The…","versions":["1.0.87-0","3.0.0-beta.45"],"error_snippets":["18:27:42.559Z [DEBUG] [rust:mcp::client] MCP request enqueued {\"request_id\":\"Number(2)\"}","18:32:41.840Z [DEBUG] [rust:log] Received close frame ... reason: \"idle timeout\"","idle timeout","In non-interactive Copilot CLI, an already-discovered Azure MCP tool call can hang after delivering its initial progress notification. No tool result is delivered, and the MCP WebSocket closes five minutes later with `id","The identical tool and payload succeed immediately when invoked directly through another MCP client (VS Code), which suggests the failure is in the Copilot CLI MCP request/session path rather than the Azure best-practice"],"workaround":null,"fixed_in":null,"score":47.7,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#1825","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":1825,"title":"Empty Input Schema Breaks Copilot CLI","url":"https://github.com/github/copilot-cli/issues/1825","state":"closed","state_reason":"completed","labels":["area:mcp","area:tools"],"created":"2026-03-04T11:30:19Z","updated":"2026-10-02T08:50:11Z","closed":"2026-09-29T10:32:53Z","reactions":10,"thumbs_up":10,"comments":3,"severity":"medium","severity_reasons":["class:mcp/tools"],"topic":"mcp/tools","classes":["mcp/tools"],"cosmetic_ui":false,"summary":"Tools with no input parameters use an empty JSON Schema for their Input Schema. This causes Copilot CLI to reject the tool entirely and fail on any prompt when the MCP server is connected. 0.0.365 Commit: 76d0881 To have an MCP tool with…","versions":["0.0.365"],"error_snippets":["✘ Model call failed: {\"message\":\"Invalid schema for function 'ai-game-developer-assets-prefab-save':","field. An empty object schema (with only","Tools with no input parameters use an empty JSON Schema for their Input Schema. This causes Copilot CLI to reject the tool entirely and fail on **any** prompt when the MCP server is connected.","Copilot is stuck producing this error again and again. Nothing else happens, doesn't matter what prompt to type. Only adding an input argument into the input json schema of the tool resolves the problem.","Copilot doesn't have the error about MCP tool with no arguments and can continue to operate and use it."],"workaround":null,"fixed_in":null,"score":47.6,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#1680","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":1680,"title":"pwsh.exe hardcoded in 6 places - CLI completely unusable on Windows 11   with only PowerShell 5.1 (closed #411 is still broken in v0.0.417)","url":"https://github.com/github/copilot-cli/issues/1680","state":"closed","state_reason":"completed","labels":["area:platform-windows","area:tools"],"created":"2026-02-25T13:31:32Z","updated":"2026-09-24T10:09:40Z","closed":"2026-09-24T10:09:40Z","reactions":13,"thumbs_up":12,"comments":9,"severity":"high","severity_reasons":["title:breakage"],"topic":"install/update","classes":["install/update"],"cosmetic_ui":false,"summary":"Issue #411 was closed as \"notplanned\" in Oct 2025, but the bug is still present and getting worse — it now blocks the CLI from running any shell command at all on Windows machines that ship only with Windows PowerShell 5.1…","versions":["5.1","0.0.417","0.0.415","0.0.414"],"error_snippets":["ensureShellIsSupported","Issue #411 was closed as \"not_planned\" in Oct 2025, but the bug is still present and getting worse — it now blocks the CLI from running **any shell command at all** on Windows machines that ship only with Windows PowerSh","The error on every single command:","<exited with error: PowerShell 6+ (pwsh) is not available. Please install it from https://aka.ms/powershell (https://aka.ms/powershell). Error: Error: Command failed: pwsh.exe --version 'pwsh.exe' is not recognized as an","0.0.417 (also reproducible on 0.0.415, 0.0.414 — any recent version)"],"workaround":null,"fixed_in":null,"score":47.4,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#4931","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":4931,"title":"Cloud agent: the built-in Playwright MCP session is already closed at the first tool call, and recovery reports it as browser OAuth required","url":"https://github.com/github/copilot-cli/issues/4931","state":"open","state_reason":null,"labels":["triage"],"created":"2026-09-22T08:58:55Z","updated":"2026-10-13T21:23:22Z","closed":null,"reactions":1,"thumbs_up":1,"comments":2,"severity":"medium","severity_reasons":["class:auth/session","class:mcp/tools"],"topic":"auth/session","classes":["auth/session","mcp/tools","always-on/daemon","self-host/headless","network"],"cosmetic_ui":false,"summary":"Split out of #4378, which carries two faults. The registry policy 401 in that issue has a cause and a workaround. This one does not, and it survives that workaround. In a Copilot cloud agent session on a GHEC data residency tenant (…","versions":["0.0.40","1.0.0"],"error_snippets":["MCP server 'playwright': Tool call failed: Error: MCP request failed: Transport closed","MCP server 'playwright': Tool call failed after session recovery:","MCPOAuthBrowserRequiredError: Browser-based OAuth required for http://localhost:3100/mcp","[ERROR] Using deferred connection for default Playwright server","tools/list after 420 seconds HTTP/1.1 200 OK (21 tools)"],"workaround":null,"fixed_in":null,"score":46.5,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#5085","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5085,"title":"Rust rewrite regression on macOS: all native HTTPS requests fail with \"bad certificate format\" when com.apple.SecurityServer is not reachable (sandboxes)","url":"https://github.com/github/copilot-cli/issues/5085","state":"open","state_reason":null,"labels":["area:networking"],"created":"2026-10-08T15:15:15Z","updated":"2026-10-09T10:28:02Z","closed":null,"reactions":1,"thumbs_up":1,"comments":0,"severity":"high","severity_reasons":["title:breakage"],"topic":"self-host/headless","classes":["self-host/headless","install/update","always-on/daemon","auth/session","network"],"cosmetic_ui":false,"summary":"Starting with 1.0.93, Copilot CLI on macOS can't connect to its API when it runs inside a sandbox that denies the Mach service com.apple.SecurityServer. Sandboxes such as nono deny this service so the agent can't read keychain secrets…","versions":["1.0.93","1.0.92","1.0.94","1.0.95-2"],"error_snippets":["[ERROR] Error loading models: Error: error sending request for url (https://copilot-api.<host>/models): client error (Connect): bad certificate format","COPILOT_GITHUB_TOKEN=\"$(gh auth token)\" sandbox-exec -p \"$prof\" copilot --prefer-version 1.0.92 -p \"Reply with just: hi\" # works","COPILOT_GITHUB_TOKEN=\"$(gh auth token)\" sandbox-exec -p \"$prof\" copilot --prefer-version 1.0.93 -p \"Reply with just: hi\" # bad certificate format","sandbox-exec","(the legacy CSSM path) to evaluate certificates and returns"],"workaround":null,"fixed_in":null,"score":45.9,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#5147","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5147,"title":"/restart fails when the CLI was launched with --new-session-id","url":"https://github.com/github/copilot-cli/issues/5147","state":"open","state_reason":"reopened","labels":["area:sessions"],"created":"2026-10-15T01:21:02Z","updated":"2026-10-25T04:19:42Z","closed":null,"reactions":0,"thumbs_up":0,"comments":1,"severity":"low","severity_reasons":["low engagement"],"topic":"mcp/tools","classes":["mcp/tools"],"cosmetic_ui":false,"summary":"Launching the CLI with --new-session-id and then running /restart fails every time: By the time this surfaces the foreground session has already been shut down, so the restart is not recoverable. copilot --new-session-id…","versions":["1.0.98"],"error_snippets":["error: the argument '--new-session-id <id>' cannot be used with '--session-id <id>'","--experimental","--no-experimental","Launching the CLI with `--new-session-id ` and then running `/restart` fails every time:","error: the argument '--new-session-id ' cannot be used with '--session-id '"],"workaround":null,"fixed_in":null,"score":44.5,"first_seen":"2026-10-25T09:11:37Z"},{"id":"github/copilot-cli#5256","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5256,"title":"High CPU and repeated \"gh auth token\" failures when not signed in (worse without gh)","url":"https://github.com/github/copilot-cli/issues/5256","state":"open","state_reason":null,"labels":["triage"],"created":"2026-10-26T07:49:42Z","updated":"2026-10-26T08:16:04Z","closed":null,"reactions":0,"thumbs_up":0,"comments":0,"severity":"medium","severity_reasons":["class:crash/hang","class:auth/session"],"topic":"crash/hang","classes":["crash/hang","auth/session","install/update"],"cosmetic_ui":false,"summary":"When Copilot CLI runs without a usable GitHub credential, the background auth probe copilotruntime::auth::gh (i.e. gh auth token) is retried in a tight loop with no backoff. I hit this in a normal interactive session using a BYOK provider…","versions":["2.103.2"],"error_snippets":["[WARNING] [rust:copilot_runtime::auth::gh] Failed to run `gh auth token` {\"error\":\"program path has no file name\",\"program\":\"\"}","$env:COPILOT_HOME = \"C:\\temp\\cp-empty\" # empty dir => no credentials","2026-10-26T07:23:17.891Z [WARNING] [rust:copilot_runtime::auth::gh] Failed to run `gh auth token` {\"error\":\"program path has no file name\",\"program\":\"\"}","2026-10-26T07:23:17.896Z [WARNING] [rust:copilot_runtime::auth::gh] Failed to run `gh auth token` {\"error\":\"program path has no file name\",\"program\":\"\"}","2026-10-26T07:23:17.899Z [WARNING] [rust:copilot_runtime::auth::gh] Failed to run `gh auth token` {\"error\":\"program path has no file name\",\"program\":\"\"}"],"workaround":{"text":"Signing in (`/login`) or exporting `COPILOT_GITHUB_TOKEN` / a fine-grained PAT stops the loop; installing `gh` only lowers the severity.","source":"issue body","url":"https://github.com/github/copilot-cli/issues/5256"},"fixed_in":null,"score":44.0,"first_seen":"2026-10-26T10:12:02Z"},{"id":"github/copilot-cli#4971","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":4971,"title":"Every hour I get Authorization error. Your credentials may be expired or invalid","url":"https://github.com/github/copilot-cli/issues/4971","state":"open","state_reason":null,"labels":["area:authentication"],"created":"2026-09-26T00:52:02Z","updated":"2026-10-04T07:04:17Z","closed":null,"reactions":2,"thumbs_up":2,"comments":3,"severity":"critical","severity_reasons":["title:data-loss/security"],"topic":"auth/session","classes":["auth/session"],"cosmetic_ui":false,"summary":"Every hour or so I'm getting Authorization error. Your credentials may be expired or invalid. (Request ID: ) Run /login to sign in again. Running /login does finish successfully but does not remedy the issue. Nor does mcp reload. GitHub…","versions":["1.0.88"],"error_snippets":["Authorization error. Your credentials may be expired or invalid. (Request ID: <AN ID>) Run /login to sign in again.","Every hour or so I'm getting `Authorization error. Your credentials may be expired or invalid. (Request ID: ) Run /login to sign in again.`","Just use the CLI for long enough. One of the messages will randomly trigger this."],"workaround":null,"fixed_in":null,"score":43.7,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#5008","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5008,"title":"Startup error \"Failed to read model provider attribution: Error: Not authenticated\" in 1.0.89","url":"https://github.com/github/copilot-cli/issues/5008","state":"closed","state_reason":"completed","labels":["area:authentication","area:models"],"created":"2026-09-30T03:11:02Z","updated":"2026-10-04T11:41:10Z","closed":"2026-10-04T11:41:10Z","reactions":5,"thumbs_up":5,"comments":7,"severity":"medium","severity_reasons":["class:auth/session"],"topic":"auth/session","classes":["auth/session"],"cosmetic_ui":false,"summary":"Since 1.0.89, every new interactive session shows this error twice right after startup: Failed to read model provider attribution: Error: Not authenticated Sign-in completes about 3 seconds later and chat/model requests work normally. It…","versions":["1.0.89","1.0.85-1.0.88"],"error_snippets":["Since 1.0.89, every new interactive session shows this error twice right after startup:","Failed to read model provider attribution: Error: Not authenticated","Sign-in completes about 3 seconds later and chat/model requests work normally. It looks like a startup race: the new provider-attribution code (`model-picker` and `model-provider-labels`) calls `model.list()` before auth","1. Authenticate via the `COPILOT_GITHUB_TOKEN` environment variable (OAuth token; no accounts stored via `/login`).","3. The error appears twice in the timeline immediately after startup."],"workaround":null,"fixed_in":null,"score":43.3,"first_seen":"2026-10-19T18:38:33Z"},{"id":"github/copilot-cli#4977","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":4977,"title":"Bundled ripgrep aborts with jemalloc 'Unsupported system page size' on 16KB-page ARM64 kernels (Asahi Linux)","url":"https://github.com/github/copilot-cli/issues/4977","state":"open","state_reason":null,"labels":["area:platform-linux","area:installation","area:tools"],"created":"2026-09-27T15:22:33Z","updated":"2026-10-25T19:33:05Z","closed":null,"reactions":0,"thumbs_up":0,"comments":2,"severity":"medium","severity_reasons":["class:install/update"],"topic":"install/update","classes":["install/update","crash/hang"],"cosmetic_ui":false,"summary":"The ripgrep binary bundled with the Copilot CLI ( /ripgrep/bin/linux-arm64/rg) statically links jemalloc built assuming a 4KB page size. On a kernel configured with a 16KB page size — the default on Asahi Linux (Linux-on-Apple-Silicon) —…","versions":["1.0.88","1.0.83","1.0.87"],"error_snippets":["$ echo hello | ~/.cache/copilot/pkg/linux-arm64/1.0.88/ripgrep/bin/linux-arm64/rg hello","memory allocation of 160 bytes failed","Aborted (exit code 134)",".../ripgrep/bin/linux-arm64/rg: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped","at each cached version's"],"workaround":{"text":"Replacing the bundled `rg` at each cached version's `ripgrep/bin/linux-arm64/rg` with the system's dynamically-linked `rg` resolves the crash locally, but is undone on every CLI update since it re-fetches the broken bundle.","source":"issue body","url":"https://github.com/github/copilot-cli/issues/4977"},"fixed_in":null,"score":41.1,"first_seen":"2026-10-26T10:12:02Z"},{"id":"github/copilot-cli#5165","harness":"copilot-cli","harness_name":"GitHub Copilot CLI","repo":"github/copilot-cli","number":5165,"title":"1.0.98: Copilot Enterprise account routed to api.business.githubcopilot.com — 401 on model catalog, 'Authentication failed' despite valid token","url":"https://github.com/github/copilot-cli/issues/5165","state":"open","state_reason":null,"labels":["area:authentication","area:enterprise"],"created":"2026-10-16T10:22:29Z","updated":"2026-10-17T05:23:27Z","closed":null,"reactions":0,"thumbs_up":0,"comments":1,"severity":"medium","severity_reasons":["class:auth/session"],"topic":"auth/session","classes":["auth/session","self-host/headless","install/update","mcp/tools"],"cosmetic_ui":false,"summary":"Copilot CLI 1.0.98 (installed via official gh.io/copilot-install script, Linux x64, headless — no system keychain, token stored in plaintext ~/.copilot/config.json) Auth via copilot login --device-code on github.com (not a GHEC…","versions":["1.0.98"],"error_snippets":["Error: Authentication failed (Request ID: ...)","Your GitHub token may be invalid, expired, or lacking the required permissions.","[ERROR] worker quit with fatal: Transport channel closed, when Client(OAuthChallenge { status_code: 401 ... })","[WARNING] MCP OAuth authorization failed; reporting the server as needing auth {\"server\":\"github-mcp-server\",\"error\":\"Browser-based OAuth required for https://api.business.githubcopilot.com/mcp/readonly\"}","[ERROR] Error loading models: Error: 401 \"Unauthorized\""],"workaround":null,"fixed_in":null,"score":40.0,"first_seen":"2026-10-23T09:23:24Z"}]}