Repository navigation
MCP: Cloudflare connection fails with "Subscription limit reached" after successful OAuth, then reports authentication required #4991
Description
Describe the bug
Cloudflare's remote MCP server fails to become available in Copilot CLI after successful OAuth authentication and protocol initialization. The runtime records:
MCP error -32603: Subscription limit reached
The MCP UI subsequently reports that the server requires authentication. Reauthenticating succeeds but leads to the same connection failure.
Evidence suggests an interoperability problem with notification subscriptions: Cloudflare intentionally rejects subscriptions/listen, and Copilot appears to treat this rejection as a fatal startup error rather than continuing without notifications. The actual outgoing RPC method was not captured, so this is a diagnosis supported by the server implementation and matching error, not a confirmed client-side call trace.
Affected version
GitHub Copilot CLI 1.0.89.
Environment: Windows, x64 distribution, PowerShell.
Observed on September 28, 2026.
Steps to reproduce the behavior
-
Configure the Cloudflare server in a workspace
.mcp.json:{ "mcpServers": { "cloudflare": { "type": "http", "url": "https://mcp.cloudflare.com/mcp", "tools": ["search", "execute"] } } } -
Start Copilot CLI and authenticate with Cloudflare through the MCP UI.
-
Observe successful authentication and protocol initialization in the logs.
-
Observe
MCP error -32603: Subscription limit reachedimmediately afterward. Cloudflare tools do not become available. -
Open the server's tool listing. It reports:
MCP server "cloudflare" requires authentication. Run `/mcp auth cloudflare` to authenticate. -
Reauthenticate. The same sequence occurs.
The failure was observed repeatedly in two runtime logs, including immediately after successful reauthentication. This was not separately reproduced with a clean profile or a standalone authenticated RPC harness.
Expected behavior
If notification subscriptions are unavailable, the client should continue with ordinary tool discovery and calls where supported, without live tool-list updates.
If a subscription failure must be fatal, preserve the actual error rather than reporting an authentication requirement after successful authentication.
Additional context
Sanitized diagnostic excerpts
These are selected events from one connection attempt; unrelated events and the verbose initialization payload are omitted.
2026-09-28T22:47:42.601Z [ERROR] Successfully authenticated with cloudflare
2026-09-28T22:47:42.846Z [INFO] [rust:rmcp::service] Service initialized as client
2026-09-28T22:47:42.874Z [DEBUG] [rust:rt_mcp::native_host] Recorded failure for server cloudflare: MCP error -32603: Subscription limit reached {"server_name":"cloudflare"}
2026-09-28T22:47:42.874Z [WARNING] [rust:copilot_runtime::session::mcp::agent_host] MCP error -32603: Subscription limit reached {"server":"cloudflare"}
2026-09-28T22:47:54.185Z [WARNING] PluginsScreenDetail listMcpTools(cloudflare) failed: Error: MCP server "cloudflare" requires authentication. Run `/mcp auth cloudflare` to authenticate.
The successful initialization payload reports:
- Protocol version:
2026-07-28 - Server:
cloudflare-api, version0.1.0 - Tools capability:
list_changed: Some(true)
The success event really is logged at ERROR severity; that is not a transcription mistake.
Relevant upstream implementation
Pinned to Cloudflare commit 259b2afc5aa84ce34461848d4fc36d817d49815e:
- MCP handler: passes
{ maxSubscriptions: 0 }tocreateMcpHandler. Its comment explicitly says the server publishes no change notifications and rejectssubscriptions/listento avoid long-lived streams. - Modern MCP tests: the test named
rejects subscriptions instead of opening a long-lived streamexpects error code-32603and messageSubscription limit reached. Separate tests cover successful ordinarytools/listandtools/callrequests.
This suggests the error is an intentional rejection of notification subscriptions, not an exhausted billing quota or evidence of invalid OAuth credentials. The advertised tool-list-change capability may also contribute to the interoperability problem.
Potential regression coverage: a server that initializes successfully, advertises tool-list changes, rejects subscriptions/listen with this error, but still supports tools/list and tools/call. Check that tools remain usable and authentication state is not incorrectly reported.
No credentials, account identifiers, or full logs are included.
Activity
miromasat commentedon Oct 4, 2026
I seeminlgy have the same issue with my Namecheap MCP.
mattzcarey commentedon Oct 5, 2026
This was a bug in Cloudflare's server, and it's fixed in cloudflare/mcp#250, which is now live on
mcp.cloudflare.com.The server reported
tools.listChanged: truebut answered everysubscriptions/listenwith-32603 Subscription limit reached. Now it:tools.listChanged: false, because the tool list never changes during a connection.subscriptions/listenthe way the 2026-07-28 spec describes: an acknowledgment with an emptynotificationsfilter, followed straight away by acompleteresult that closes the stream.Cloudflare tools should now load in Copilot CLI with the config from the original report. @domgordon-MSFT, could you confirm it works for you?
On the Copilot side, a few things from the report are still worth fixing for other servers:
Tak2121 commentedon Oct 5, 2026
domgordon-MSFT commentedon Oct 7, 2026
Thanks @mattzcarey! Confirmed working in my October 5 retest with the original Cloudflare MCP configuration. Both tools loaded and ran successfully:
searchreturned API documentation, andexecutecompleted an authenticated, read-only Cloudflare API request with HTTP 200. The originalSubscription limit reachedfailure and subsequent authentication error did not recur. No configuration workaround was needed. This confirms the original Cloudflare connection problem is resolved for me; I have not independently verified the remaining Copilot-side error-handling concerns.copilot-cli-bot commentedon Oct 15, 2026
This appears to be resolved as of GitHub Copilot CLI v1.0.98. Please update to that release or a newer stable version. We're closing this as completed. If it still happens, please comment with your version and reproduction steps.