Repository navigation
Shared MCP Token Cache Across CLI Sessions #2780
Copy link
Copy link
Closed
Labels
area:authenticationLogin, OAuth, device auth, token management, and keychain integrationLogin, OAuth, device auth, token management, and keychain integrationarea:mcpMCP server configuration, discovery, connectivity, OAuth, policy, and registryMCP server configuration, discovery, connectivity, OAuth, policy, and registry
Description
Describe the feature or problem you'd like to solve
No response
Proposed solution
Feature Request: Shared MCP Token Cache Across CLI Sessions
Problem
Each Copilot CLI terminal/session maintains its own independent MCP connections and token cache. When a token expires:
- Running
/mcp reloadin Terminal A does NOT fix Terminal B - Each terminal must be individually refreshed
- Users working with multiple CLI sessions (common for parallel workflows) must reload each one
This is inconsistent with how other developer tools work — az login, gh auth login, and docker login all share credentials across terminal sessions on the same machine.
Proposed Solution
Shared token cache: MCP server OAuth tokens should be stored in a machine-local cache (e.g., OS keychain or a file-based token cache) that all CLI sessions on the same machine can read from.
Implementation suggestions
- Store MCP OAuth tokens in a shared location:
- Windows: Windows Credential Manager or
~/.copilot/mcp-token-cache/ - macOS: Keychain Access
- Linux:
libsecret/gnome-keyringor file-based fallback
- Windows: Windows Credential Manager or
- When a CLI session needs an MCP token, check the shared cache first
- When any session refreshes a token (via
/mcp reloador auto-refresh), update the shared cache - Include a file lock or atomic write mechanism to prevent race conditions
- Optional: a
--no-shared-cacheflag for users who want isolated sessions
Interaction with auto-refresh (Feature Request #1)
If auto-refresh is implemented, the shared cache becomes even more valuable:
- One session refreshes the token → all sessions benefit immediately
- No "thundering herd" of multiple sessions trying to refresh simultaneously
Environment
- Copilot CLI on Windows (PowerShell)
- Multiple terminal sessions on the same machine
- MCP servers using Entra ID (Azure AD) OAuth
Current Workaround
When tokens expire, users must run /mcp reload in every open CLI session individually. There is no way to refresh once and have all sessions pick up the new token.
Example prompts or workflows
No response
Additional context
No response
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
area:authenticationLogin, OAuth, device auth, token management, and keychain integrationLogin, OAuth, device auth, token management, and keychain integrationarea:mcpMCP server configuration, discovery, connectivity, OAuth, policy, and registryMCP server configuration, discovery, connectivity, OAuth, policy, and registry
Activity
copilot-cli-bot commentedon Oct 2, 2026
This appears to be resolved as of GitHub Copilot CLI v1.0.91. Please update to that release or a newer stable version. We're closing this as completed. If it still happens, please comment with your version and reproduction steps.