Repository navigation
Copilot sends ping on the 2026-07-28 protocol, and reuses rotated refresh tokens #5079
Description
Activity
We're seeing this on the Microsoft Learn MCP Server too: a large number of
pingrequests fromcopilot-clithat fail with HTTP 404 (JSON-RPC-32601, method not found), sincepingwas removed in the2026-07-28revision. These failed pings are roughly 10–100x the volume of normal MCP requests (server/discover,tools/list,tools/call).What copilot-cli sends
The whole session runs on
2026-07-28:server/discover, thentools/list, thenpingabout every 21 seconds while idle. The pings come from the session's own MCP client, since their JSON-RPC ids continue fromtools/list. They don't come from the OAuth probe, which pings on2025-11-25. NoMcp-Session-Idis sent.- Headers:
MCP-Protocol-Version: 2026-07-28,Mcp-Method: ping,User-Agent: copilot-cli,Accept: text/event-stream, application/json params._meta:io.modelcontextprotocol/protocolVersion:"2026-07-28"io.modelcontextprotocol/clientInfo:{"name":"copilot-cli","version":"1.0.93-1"}io.modelcontextprotocol/clientCapabilities:{"sampling":{}}progressToken:3
Captured request (copilot-cli 1.0.93-1):
POST /mcp Accept: text/event-stream, application/json Content-Type: application/json MCP-Protocol-Version: 2026-07-28 Mcp-Method: ping User-Agent: copilot-cli {"jsonrpc":"2.0","id":4,"method":"ping","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientInfo":{"name":"copilot-cli","version":"1.0.93-1"},"io.modelcontextprotocol/clientCapabilities":{"sampling":{}},"progressToken":3}}}
Local repro
Setup: one session with one tool call, then idle, against a local MCP server behind a logging proxy, with auto-update off. The server's answer doesn't change the ping rate, and there were no reconnects in either case.
Client Server answer to pingIdle time pingrequests1.0.93-1 HTTP 404, -32601150 s 6, ~21 s apart 1.0.93-1 HTTP 200, {}150 s 6, ~21 s apart 1.0.93 n/a 180 s 0 The stable 1.0.93 build didn't send
pingin the same setup, so this may already be fixed there. We haven't tested 1.0.94.Expected: don't send
pingon sessions that negotiated2026-07-28or later (removed in SEP-2575), or at least stop after a-32601response. Against servers that rejectping, every idle session currently produces about 170 failed requests an hour.Reacted by Osmond Jiang- Headers:
This has been resolved from 1.0.93 stable onwards.
Describe the bug
Where: github/copilot-cli (public issues). The GitHub Copilot desktop
app's MCP sessions identify as
copilot-cliin the MCPclientInfo.1.
pingafter negotiating the new protocolAgainst a server built on modelcontextprotocol/go-sdk (via Obot), the
session negotiates the 2026-07-28 protocol (it uses
subscriptions/listen) but still sendspingabout every 20 seconds.go-sdk rejects
initialize,ping,notifications/initialized,logging/setLevelandresources/(un)subscribeon that protocol with-32601 "ping" is not supported in the new protocol. Our audit log shows27 failed
pings in 10 minutes from one desktop session. Expected: nopingon protocol versions that removed it (use the new protocol'skeep-alive), or negotiate an older version.
2. Reuses rotated refresh tokens
The desktop app (OAuth
client_idhttps://github.com/copilot/desktop/client-metadata.json) sends the samerefresh token several times within a second, and sometimes abandons the
request midway. Against a server that rotates refresh tokens (recommended
by OAuth 2.1 for public clients), every reuse fails and the user is
repeatedly asked to sign in. VS Code, against the same server, never reuses
a token. Expected: serialize refreshes per server, and save the rotated
token before the next use.
Affected version
Version 1.1.27
Steps to reproduce the behavior
No response
Expected behavior
No response
Additional context
No response