MCP HTTP transport's "basic connectivity" preflight ignores stored OAuth token, causing a permanent reconnect loop against servers requiring auth on every request

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary:
When connecting/reconnecting to an HTTP MCP server that requires a valid Bearer token on every request (no anonymous access at all), Claude Code
successfully completes the OAuth flow and stores a valid token, but the very next action — a "basic HTTP connectivity" preflight check — sends an
unauthenticated request to the same URL. That preflight predictably gets 401 from the server. Instead of proceeding to the real authenticated MCP
session using the token it just saved, Claude Code treats the preflight's 401 as a signal to start an entirely new interactive OAuth flow — but
since this happens inside non-interactive reconnect logic ("Redirection handling is disabled"), that second flow can't open a browser and
immediately fails. The server-provided token is discarded/unused, and the server connection is permanently stuck in "Needs authentication," even
though authentication just succeeded seconds earlier.

What Should Happen?

After a successful OAuth exchange, Claude Code should use the newly stored access token on all subsequent requests to the MCP server, including whatever preflight/connectivity check precedes the real session — or skip/adjust that preflight when hasAuthProvider: true and a valid, unexpired token is already present.

Error Messages/Logs

Got new credentials, but reuters-product-connector rejected them on reconnect. Try re-authenticating, or restart Claude Code if it persists.

Steps to Reproduce

1. Configure an HTTP MCP server with OAuth (client_id/client_secret/callback_port) pointing at a server that:

• Requires a valid Bearer token with a specific scope on every POST to the MCP endpoint (no isAnonymous() exceptions on that path).
• Correctly serves RFC 9728 /.well-known/oauth-protected-resource metadata.

1. Run claude --debug-file debug.log.
2. Run /mcp, select the server, choose Re-authenticate.
3. Complete the browser login — it shows "Authentication successful."
4. Observe the server's status never becomes "connected" — it reports Needs authentication or the error toast: "Got new credentials, but <server>

rejected them on reconnect. Try re-authenticating, or restart Claude Code if it persists."

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.292 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

IntelliJ IDEA terminal

Additional Information

_No response_