[BUG] Supabase MCP OAuth fails in VSCode extension but works in terminal

[wisesignal]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

Description
Supabase MCP server authentication fails when using Claude Code via the VSCode extension, but works correctly when using Claude Code in the terminal. Both use the same configuration in ~/.claude.json.

Environment
Platform: macOS (Darwin 25.3.0)
Claude Code: VSCode extension (latest)
Claude Code terminal: works correctly

What Should Happen?

Expected Behavior

VSCode extension should handle Supabase MCP OAuth the same way the terminal does — redirecting to browser for authentication.

Error Messages/Logs

{"message":"resource: Resource must be a valid MCP endpoint"}

Steps to Reproduce

Steps to Reproduce

• Configure Supabase MCP server in ~/.claude.json:

"supabase-production": {
"type": "http",
"url": "https://mcp.supabase.com/mcp?project_ref=<project_ref>"
}

• Open Claude Code in VSCode extension
• Attempt to authenticate the Supabase MCP server
• Error appears: {"message":"resource: Resource must be a valid MCP endpoint"}
• Open Claude Code in terminal (claude CLI)
• Run /mcp — OAuth browser redirect works, authentication succeeds

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.76

Claude Code Version

2.1.75

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

VS Code integrated terminal

Additional Information

Additional Context
Initially the URL contained extra query params (&read_only=true&features=database,functions,debugging) and a trailing newline, which produced a slightly different error: {"message":"resource: Resource must be a valid MCP endpoint, : Unrecognized key(s) in object: 'read_only', 'features'"}. After cleaning the URL, the error simplified to {"message":"resource: Resource must be a valid MCP endpoint"}.

Clearing ~/.claude/mcp-needs-auth-cache.json and restarting does not resolve the issue in VSCode.
/doctor and /mcp in the extension do not trigger the OAuth browser redirect properly.

The staging Supabase MCP server (same config format, different project ref) exhibits the same behavior.

Potential Root Cause

The VSCode extension double-encodes the URL query parameter when constructing the OAuth resource parameter:

• Expected: resource=https://mcp.supabase.com/mcp?project_ref=xxx
• Actual: resource=https://mcp.supabase.com/mcp%253Fproject_ref=xxx

%253F = the ? was encoded to %3F, then the % was encoded again to %25, producing %253F. The OAuth server correctly rejects this as an invalid MCP endpoint.

Full OAuth URL observed:
https://api.supabase.com/v1/oauth/authorize?...&resource=https://mcp.supabase.com/mcp%253Fproject_ref=pzsbrsbvvjhthrxpqjbb

The terminal CLI constructs the same OAuth flow with correct encoding and succeeds.

Related Issues

• [BUG] MCP server named "supabase" ignores stdio configuration and forces SSE/OAuth connection #21368 — MCP initialization race condition in VSCode (stdio servers, different root cause)

[github-actions]

Found 3 possible duplicate issues:

1. [BUG] Supabase HTTP MCP connected in CLI but tools not available in VSCode extension #33989
2. [BUG] MCP servers configured via CLI don't load in VSCode extension #24770
3. HTTP MCP servers with OAuth: tools not registered after successful auth #29697

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[wisesignal]

Update: Root cause identified + workaround

Root cause

The VSCode extension double-encodes the URL query parameter when constructing the OAuth resource parameter:

• Expected: resource=https://mcp.supabase.com/mcp%3Fproject_ref=xxx
• Actual: resource=https://mcp.supabase.com/mcp%253Fproject_ref=xxx

%253F = the ? was first encoded to %3F, then the % was encoded again to %25, producing %253F. The OAuth server correctly rejects this as an invalid MCP endpoint.

Workaround

When the OAuth page opens in the browser, manually edit the URL and change %253F to %3F, then submit. OAuth completes successfully and the token is cached — only needs to be done once per token expiry.

Terminal CLI comparison

The terminal CLI (claude command) constructs the same OAuth flow wi

[github-actions]

Closing for now — inactive for too long. Please open a new issue if this is still relevant.

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.