README.md

@@ -318,7 +318,7 @@ first connection attempt:
   matching mode to **Regex** so any port works without re-registering:
 
   ```
-  http://(localhost|127\.0\.0\.1):[0-9]+/.*
+  ^http://(127\.0\.0\.1|localhost):\d+(/.*)?$
   ```
 
   **The port is not optional.** Authentik rejects a portless
@@ -571,7 +571,7 @@ What happens:
 `--callback-port` is required because your IdP only accepts pre-registered
 redirect URIs. Pick any free port; just make sure the matching URI is in
 your MCP client's **Redirect URIs** list. Authentik users with the regex
-entry from the setup step (`http://(localhost|127\.0\.0\.1):[0-9]+/.*`) can
+entry from the setup step (`^http://(127\.0\.0\.1|localhost):\d+(/.*)?$`) can
 use any port without re-registering.
 
 ### C. Manual-paste fallback (when loopback isn't reachable)

docs/oidc-entra-id.md

@@ -241,7 +241,7 @@ prompt. See README → *Which redirect URIs to register*.
 `http://localhost` redirect URIs, so the single registration
 `http://localhost/callback` matches `http://localhost:33418/callback`,
 `http://localhost:9999/callback`, and any other port. This is Entra's
-equivalent of the Authentik regex (`http://(localhost|127\.0\.0\.1):[0-9]+/.*`)
+equivalent of the Authentik regex (`^http://(127\.0\.0\.1|localhost):\d+(/.*)?$`)
 the README mentions — users can pick any `--callback-port` without
 re-registering.