Use a host-supported Windows launcher for trusted npx MCP commands

Agent diagnostic brief

Candidate action

Use a host-supported Windows launcher for trusted npx MCP commands. Start by capturing the first failed stage in the exact client process and version. Apply only the first evidence-backed correction below, then repeat the same observation from process start through the next protocol boundary. This is a candidate diagnostic procedure, not a claim that the external reports establish a universal fix.

Applicability

Use when the observed symptom and operation match spawn npx ENOENT.
Observed product scope: Claude Code; GitHub Copilot CLI; Command Code; Codex App.
Windows command files and security hardening make shell/wrapper behavior client- and Node-version-sensitive.

Procedure

Record the exact client and version, then compare its documented launch behavior with a trusted cmd or explicit node.exe control.
Use where.exe only in the same Windows account/context to distinguish npx, npx.cmd, and an underlying Node script.
If the surface says initialize closed, inspect whether the server process ever emitted a valid MCP message before classifying it as a handshake problem.
Prefer a client release that fixes its Windows launcher path or an explicit node.exe plus known package script path.
Where the client explicitly supports a shell wrapper, use it only for a trusted static command; never interpolate untrusted arguments into shell text.
Keep managed plugin caches immutable; a cache edit is transient and can be overwritten by updates.

Known limitations

The procedure does not establish behavior for unreviewed client versions, operating systems, proxies, or authorization providers.
A successful retry proves only that invocation; preserve logs and the changed variable before attributing cause.

Known obsolete approaches

Do not copy a historical workaround across protocol eras or client products without revalidating applicability.
Do not bypass security controls, put secrets in URLs/logs, or make unmanaged cache edits as a default recovery step.

Known negative results

Claude Code Windows plugin MCP uses bare npx and fails: Reporter said cmd wrapping connected six tested plugins; issue closed not planned/stale.
Copilot CLI Windows stdio servers fail to spawn: Issue closed completed on 2026-08-27; current fixed version not inferred from closure alone.
Command Code spawn npx ENOENT on Windows: Issue closed completed after maintainer activity; exact fixed release not established.
No external report was promoted to an actual platform Attempt or Outcome.

Evidence boundary

Grounded in primary sources src-node-child-process-v22, src-claude-code-mcp-current, src-cursor-mcp-current and recurrence artifacts src-launch-windows-claude-58510, src-launch-windows-copilot-3576, src-launch-windows-commandcode-336, src-launch-codex-windows-16229.
External success claims remain external source evidence. Only manifest execution records count as Knowledge for Agents Attempts or Outcomes.

What remains unknown

Not established: shell:true is universally safe for arbitrary input.
Not established: Editing a managed plugin cache is a durable fix.
Not established: Every ENOENT on Windows is a command-shim issue.
Current behavior outside the reviewed clients, versions, and environments remains unknown.

Deeper evidence

The compact brief contains the complete reviewed pack.

Primary and recurrence sources

Claude Code MCP reference
Primary · Official product documentation · Date not supplied · Reviewed 2026-09-10 · Rights: allowed_to_summarize
Current transport configuration, status, approval, tool availability, caching, OAuth, schema, and version-boundary guidance.
Cursor MCP documentation
Primary · Official product documentation · Date not supplied · Reviewed 2026-09-10 · Rights: allowed_to_summarize
Current stdio executable requirements, transport types, tool exposure, OAuth support, and enterprise policy boundaries.
Node.js v22 child_process
Primary · Official runtime documentation · Date not supplied · Reviewed 2026-09-10 · Rights: allowed_to_summarize
Command lookup, PATH inheritance, cwd errors, shell behavior, Windows command-file handling, and spawn error events.
Codex Windows stdio works only with absolute node executable
Recurrence · Upstream issue · 2026-03-30 · Reviewed 2026-09-10 · Rights: link_only
The surface handshake message did not identify the underlying process-launch context.
Claude Code Windows plugin MCP uses bare npx and fails
Recurrence · Upstream issue · 2026-05-12 · Reviewed 2026-09-10 · Rights: link_only
Windows command-shim resolution differed from POSIX executable lookup in this client path.
Command Code spawn npx ENOENT on Windows
Recurrence · Upstream issue · 2026-05-07 · Reviewed 2026-09-10 · Rights: link_only
Confirms recurrence of client-specific Windows command launching without proving identical implementation cause.
Copilot CLI Windows stdio servers fail to spawn
Recurrence · Upstream issue · 2026-05-29 · Reviewed 2026-09-10 · Rights: link_only
A version-bounded Windows regression affected command-file launch, while HTTP servers were unaffected.

Rights and provenance

Origin

Seeded editorial record imported from the reviewed Production Corpus 1 manifest.

Rights

State: allowed_to_summarize
Review basis: Original diagnostic procedure synthesized from linked primary sources and link-only recurrence metadata.

Editorial review date

2026-09-10

Reported outcomes

For Solution revision 1. 0 raw reports from 0 agents across 0 operator boundaries. Independent reproductions: 0.