HTTP MCP server with Bearer header fails to connect — same OAuth-discovery pattern as #46640

[wilberbatista98-ai]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

An HTTP-type MCP server configured with a static Bearer token header (no OAuth expected or configured) fails to connect. The client appears to attempt an OAuth discovery probe against the server even though only a static Authorization header was configured, and fails hard when the server's response to that probe doesn't match the expected OAuth metadata schema — instead of falling back to the configured header auth. Same failure class as #46640, but here it's reproducible via the CLI too, not just the VS Code extension.

What Should Happen?

Since the server is configured with a static Authorization header and never advertised OAuth support, the client should either skip OAuth discovery entirely for servers with pre-configured static headers, or gracefully fall back to the header auth when discovery fails — instead of hard-failing the whole connection.

Error Messages/Logs

CLI (claude mcp get clickmax):
Status: ✗ Failed to connect

VS Code extension (Claude Code for VS Code), MCP servers panel:

SDK auth failed: [
  { "expected": "string", "code": "invalid_type", "path": ["issuer"], "message": "Invalid input: expected string, received undefined" },
  { "expected": "string", "code": "invalid_type", "path": ["authorization_endpoint"], "message": "Invalid input: expected string, received undefined" },
  { "expected": "string", "code": "invalid_type", "path": ["token_endpoint"], "message": "Invalid input: expected string, received undefined" },
  { "expected": "array", "code": "invalid_type", "path": ["response_types_supported"], "message": "Invalid input: expected array, received undefined" }
]

On reconnect attempt, the raw response also fails JSON-RPC 2.0 schema validation with unrecognized keys "message", "error", "statusCode" — consistent with the server returning a generic REST error body instead of valid MCP JSON-RPC or OAuth metadata.

Environment:
- Claude Code CLI: 2.1.87
- Claude Code for VS Code extension: 2.1.218
- OS: Windows 10

Steps to Reproduce

1. Configure a project-scoped HTTP MCP server in .mcp.json with a static Bearer token header:
   {
   "mcpServers": {
   "clickmax": {
   "type": "http",
   "url": "https://ai.clickmax.io/mcp",
   "headers": {
   "Authorization": "Bearer ${CLICKMAX_MCP_TOKEN}"
   }
   }
   }
   }
2. Set the token as an environment variable in .env (confirmed valid and active on the provider's own dashboard).
3. Run claude mcp get clickmax in a fresh terminal → Status: Failed to connect.
4. Remove and re-add the server from scratch via claude mcp remove + claude mcp add --transport http → same failure persists.
5. Open the same project in Claude Code for VS Code extension → MCP servers panel shows "Failed" with the OAuth-discovery-shaped error above.

Note: this server worked correctly ~1 week prior, with no known change to the token or the server's URL/config in the meantime.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Unknown — same install, stopped working without any known Claude Code update or config change (~1 week gap)

Claude Code Version

2.1.87 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

This bug was found while using the Claude Code for VS Code extension (v2.1.218) — same connection failure reproduces both there and in a standalone terminal with the CLI. Also note: claude mcp list / claude mcp get fail on Windows unless CLAUDE_CODE_GIT_BASH_PATH is set manually, which is a separate minor issue but relevant context for reproducing on Windows.

[bcherny]

Thanks for the detailed report. Two findings:

1. The behavior you describe — Claude Code trying OAuth discovery for an HTTP MCP server that already has a static Authorization header — was fixed in 2.1.157. Since then, when headers.Authorization is set, no OAuth discovery is attempted at all; a rejected token shows Server rejected the configured Authorization header (HTTP 401) instead. Your CLI is on 2.1.87, which predates the fix. I verified on 2.1.233 with a test server returning 401: no OAuth probe, just the header-rejected message. Changelog: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

2. The remaining failure looks server-side. Right now POST https://ai.clickmax.io/mcp answers HTTP 200 with the body {"message":"Route POST:/mcp not found","error":"Not Found","statusCode":404} no matter what token is sent — that's what produces the "unrecognized keys message/error/statusCode" JSON-RPC error you saw. On 2.1.233 I get the same result with your exact .mcp.json. That endpoint appears to have moved or been removed, which would explain it working a week earlier with no change on your side — please check with the provider for the current MCP URL.

Also note: Claude Code doesn't load .env files, so ${CLICKMAX_MCP_TOKEN} must be set in your shell/system environment (a missing variable shows a "Missing environment variables" warning in claude mcp get).

Closing as fixed in 2.1.157 — please update and reply here if you still hit an OAuth-discovery error on the current version.

🤖 Generated with Claude Code