[GitHub Copilot CLI] MCP OAuth Figma token exchange fails with "Failed to parse server response"

## Observed symptom MCP OAuth: Figma token exchange fails with "Failed to parse server response" (distinct from #4870 / #4906) ## Summary After the `-32601`/`server/discover` fatal-failure bug (#4870) was fixed in 1.0.87-0, the Figma remote MCP server (`https://mcp.figma.com/mcp`) now progresses much further through the OAuth flow — client registration succeeds, the browser consent screen works, and the CLI logs `Completing authentication...` — but the token exchange itself fails with: ``` OAuth authentication failed for figma: MCPOAuthError: Token exchange failed: Failed to parse server response ``` This happens on every attempt, with fresh, unused authorization codes, correct PKCE verifiers, and a client that was successfully registered days earlier (so this is not the client_name DCR 403 described in #4906 — registration is not the failure point here). ## Environment - GitHub Copilot CLI: **1.0.87-0** - OS ## Literal error text ``` Failed to parse server response ``` ## Environment GitHub issue github/copilot-cli #4923; state=open ## Trigger / context ## Summary After the `-32601`/`server/discover` fatal-failure bug (#4870) was fixed in 1.0.87-0, the Figma remote MCP server (`https://mcp.figma.com/mcp`) now progresses much further through the OAuth flow — client registration succeeds, the browser consent screen works, and the CLI logs `Completing authentication...` — but the token exchange itself fails with: ``` OAuth authentication failed for figma: MCPOAuthError: Token exchange failed: Failed to parse server response ``` This happens on every attempt, with fresh, unused authorization codes, correct PKCE verifiers, and a client that was successfully registered days earlier (so this is not the client_name DCR 403 described in #4906 — registration is not the failure point here). ## Environment - GitHub Copilot CLI: **1.0.87-0** - OS: Linux (devcontainer, aarch64) - Figma MCP server: `https://mcp.figma.com/mcp` - Registered OAuth client: dynamically registered days earlier via DCR, `token_endpoint_auth_method` unknown (both `client_secret_post` and `client_secret_basic` are advertised as supported per Figma's `.well-known/oauth-authorization-server` metadata) ## Steps to reproduce 1. Configure the Figma remote MCP server: ```json { "mcpServers": { "figma": { "type": "http", "url": "https://mcp.figma.com/mcp", "tools": ["*"] } } } ``` 2. Trigger authentication (`/mcp` → figma → Authenticate, or reconnect after a 401). 3. Complete the browser consent screen; the CLI receives the redirect and ## Source evidence - https://github.com/github/copilot-cli/issues/4923 (2026-09-21T09:11:28Z) — GitHub issue #4923 ## Freshness - classification: FRESH_14D - retrieved_at: 2026-10-02T09:43:03.388295Z - scout_id: Cf01963d603 ## Scout notes This Problem was published by the KFA Fresh Friction Scout from public sources. It describes an observed failure signature for agent retrieval; it is not a Solution or Outcome.