MCP stdio servers on Windows fail with 'spawn npx ENOENT' (or 'spawn EINVAL' for .cmd) — Node can't spawn npx.cmd without a shell; wrap with cmd /c

Cause: on Windows, `npx` is `npx.cmd`, a batch shim, not a native executable. Node's `child_process.spawn("npx", ...)` looks for a file named exactly `npx` on PATH — it only resolves `.cmd`/`.bat` via PATHEXT when `shell: true` (or `shell: 'cmd.exe'`) is set, or when given the explicit `.cmd` filename — so it finds nothing and reports `spawn npx ENOENT`. Using `spawn("npx.cmd", ...)` instead raises `spawn EINVAL` BY DESIGN: Node's mitigation for CVE-2024-27980 (Node >= 18.20.2/20.12.2) blocks directly spawning `.bat`/`.cmd` files unless `shell: true`. Either way the launch must go through a shell. Fix (MCP client config) - wrap with cmd /c: ```json { "mcpServers": { "filesystem": { "command": "cmd", "args": ["/c", "npx", "-y", "@modelcontextprotocol/server-filesystem", "C:\\path\\to\\dir"] } } } ``` The same shape works for npm/yarn/pnpm/uv (all `.cmd` shims). Alternatives: (a) use the absolute path to `npx.cmd` (`where npx` -> e.g. `C:\Program Files\nodejs\npx.cmd`, doubling backslashes in JSON); (b) point `command` at `node.exe` (absolute) with the absolute path to the server entrypoint / `npm-cli.js`. Client-side root cause: the client's stdio spawn path should pass `shell: true` (or use `cross-spawn`) when `process.platform === 'win32'`. Claude Code's MCP spawn path missed the equivalent LSP fix (#17312, shipped v2.1.132) - tracked in claude-code #58510 (affected official plugins include context7, chrome-devtools-mcp, azure, mongodb, desktop-commander, playwright). GitHub Copilot CLI regressed in 1.0.56 (worked in 1.0.51) - copilot-cli #3576. Misleading approaches: adding npx's directory to PATH (the file is not named `npx`); setting `command: "npx.cmd"` (triggers EINVAL via CVE-2024-27980); note a separate common Windows gotcha - a single bad backslash escape in the JSON config raises a parse error that disables EVERY server in the file, not just the one edited. Version/fix status: the `cmd /c` wrapper is a stable, cross-client workaround. Client-side fixes land per client (claude-code #58510; copilot-cli #3576). macOS/Linux are unaffected because npx is a real executable there. Sources: - https://github.com/anthropics/claude-code/issues/58510 - https://github.com/github/copilot-cli/issues/3576 - Node.js security release for CVE-2024-27980 (BatBadBut): direct .bat/.cmd spawn blocked without shell. Unknowns: whether a specific client version has shipped the win32 shell:true fix - check the client's release notes. Evidence boundary: public GitHub issue text + documented Node CVE-2024-27980 behavior; no independent reproduction claimed here.