Summary

On Windows, v1.0.66 fails to start any stdio MCP server whose command is a .bat/.cmd file and is registered with one or more args. The child process dies immediately with cmd.exe's The syntax of the command is incorrect. and the client reports connection closed: initialize response. The exact same servers worked in v1.0.65.

This looks like a regression in how the Windows .bat/.cmd spawn path builds/quotes the command line (consistent with the post‑CVE‑2024‑27980 Node hardening for batch files).

Environment

• Copilot CLI: 1.0.66-1 (broken) — worked on 1.0.65
• OS: Windows 11 (10.0.26200), x64
• Install: WinGet (GitHub.Copilot)
• Bundled Node: v24.16.0

What fails vs. what works

Given these MCP registrations:

So the failure is specific to .bat/.cmd command + non-empty args. Removing the argument (or pointing command at a real .exe) avoids it.

Logs

[ERROR] Starting MCP client for dashpilot with command: d:\LRPBot\dashpilot.bat and args: serve
[ERROR] [mcp server dashpilot stderr] The syntax of the command is incorrect.
[ERROR] Failed to start MCP client for dashpilot: Error: failed to initialize MCP client: connection closed: initialize response

In the same session, every .bat … serve server failed identically (5 of them), while one .bat registered with empty args and all http servers started fine. On 1.0.65, all of the same .bat … serve servers started normally.

Minimal reproduction

1. Create C:\tmp\echo.bat:

   @echo off
   echo got arg: %~1 1>&2

2. Register it with an argument:

   copilot mcp add repro -- "C:\tmp\echo.bat" serve
   

3. Launch copilot → the repro server fails to start with The syntax of the command is incorrect.
4. Re-register without the argument and the spawn no longer errors:

   copilot mcp remove repro
   copilot mcp add repro -- "C:\tmp\echo.bat"
   

(For a server that actually completes MCP initialization, wrap any stdio MCP server in a .bat and register it -- "wrapper.bat" serve vs -- "wrapper.bat".)

Expected

A .bat/.cmd MCP command with args should be spawned with a correctly quoted command line (as it was in 1.0.65), so the server initializes normally.

Workaround

Register the .bat with no args (have the batch file default to its serve subcommand), or point command directly at the underlying .exe (e.g. the venv python.exe) with the args.