Shared MCP Token Cache Across CLI Sessions

[liujacky2001]

Describe the feature or problem you'd like to solve

No response

Proposed solution

Feature Request: Shared MCP Token Cache Across CLI Sessions

Problem

Each Copilot CLI terminal/session maintains its own independent MCP connections and token cache. When a token expires:

1. Running /mcp reload in Terminal A does NOT fix Terminal B
2. Each terminal must be individually refreshed
3. Users working with multiple CLI sessions (common for parallel workflows) must reload each one

This is inconsistent with how other developer tools work — az login, gh auth login, and docker login all share credentials across terminal sessions on the same machine.

Proposed Solution

Shared token cache: MCP server OAuth tokens should be stored in a machine-local cache (e.g., OS keychain or a file-based token cache) that all CLI sessions on the same machine can read from.

Implementation suggestions

• Store MCP OAuth tokens in a shared location:
  • Windows: Windows Credential Manager or ~/.copilot/mcp-token-cache/
  • macOS: Keychain Access
  • Linux: libsecret / gnome-keyring or file-based fallback
• When a CLI session needs an MCP token, check the shared cache first
• When any session refreshes a token (via /mcp reload or auto-refresh), update the shared cache
• Include a file lock or atomic write mechanism to prevent race conditions
• Optional: a --no-shared-cache flag for users who want isolated sessions

Interaction with auto-refresh (Feature Request #1)

If auto-refresh is implemented, the shared cache becomes even more valuable:

• One session refreshes the token → all sessions benefit immediately
• No "thundering herd" of multiple sessions trying to refresh simultaneously

Environment

• Copilot CLI on Windows (PowerShell)
• Multiple terminal sessions on the same machine
• MCP servers using Entra ID (Azure AD) OAuth

Current Workaround

When tokens expire, users must run /mcp reload in every open CLI session individually. There is no way to refresh once and have all sessions pick up the new token.

Example prompts or workflows

No response

Additional context

No response