Azure MCP server fails sending HTTP request

Trước tiên, hãy tái hiện yêu cầu tới registry Azure MCP bằng Copilot CLI 1.0.83, sau đó kiểm tra đường dẫn yêu cầu Rust reqwest 0.13.4/hyper native và TLS backend của nó trong quá trình renegotiation chứng chỉ client TLS 1.2 bị trì hoãn. Được xem là hoàn tất khi registry trả về thành công thay vì BrokenPipe, với coverage cho TLS flow dành riêng cho endpoint này.

Describe the bug

This broke overnight. We've been using the same Azure MCP registry for months fine.

Copilot CLI Rust runtime fails with BrokenPipe when validating Azure API Center MCP registry.

GitHub Copilot CLI 1.0.83 cannot validate MCP servers against an Azure API Center registry when enterprise MCP access is configured as Registry only.

The CLI connects successfully to the registry IP, but its native Rust runtime fails before receiving an HTTP response:

[rust:log] starting new connection 'Some("...azure-apicenter.ms")'
[rust:hyper_util::client::legacy::connect::http] connected to ...:443
[rust:hyper_util::client::legacy::client] client connection error:
hyper::Error(Shutdown, Os {
  code: 32,
  kind: BrokenPipe,
  message: "Broken pipe"
})

The same exact registry endpoints return HTTP 200 using both curl and Node.js fetch on the same machine.

A verbose curl trace shows that after the GET request is sent, the Azure endpoint initiates TLS 1.2 renegotiation and requests a client certificate:

Request completely sent off
TLSv1.2 (IN), TLS handshake, Hello request
TLSv1.2 (IN), TLS handshake, Request CERT
HTTP/1.1 200 OK

Copilot CLI logs show that registry requests use the native Rust runtime, specifically reqwest 0.13.4/hyper, rather than Node fetch. The Rust request terminates with BrokenPipe during this endpoint-specific TLS flow.

Please investigate compatibility between the Copilot CLI native runtime’s TLS backend and delayed TLS 1.2 client-certificate renegotiation.

Affected version

GitHub Copilot CLI 1.0.83

Steps to reproduce the behavior

Use GitHub Enterprise (Cloud) and GitHub Copilot Enterprise.

1. have an Azure MCP registry setup.
2. Enter the Azure URL into the MCP Registry URL
3. Select "Registry Only" for "Restrict MCP access to registry servers"
4. See a Failed to load registry: Error: HTTP request failed: error sending request for url ( <redacted> ) error message

Expected behavior

MCP registry support works

Additional context

macOS, MBP Pro ARM, iTerm2