[BUG] `claude mcp remove -s local` deletes the OAuth tokens still used by the same server in user scope (logs out every session)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

OAuth tokens are stored once per name|hash(config) in ~/.claude/.credentials.json. When the same HTTP MCP server (same name and URL) is defined in both user and local scope, removing only the local definition also deletes that shared token entry. The user-scope server is still configured, but every session on the machine immediately needs to re-authenticate. With many concurrent sessions (worktrees, agent threads), they all lose the server at once.

What Should Happen?

Removing a server from one scope should not delete credentials while another scope (or another project) still references the same server config. At minimum, mcp remove should warn that it will sign out other sessions.

Error Messages/Logs

$ claude mcp list            # from ~
demo: https://<oauth-mcp-server>/mcp (HTTP) - ✔ Connected
$ cd /some/dir && claude mcp remove demo -s local
$ cd ~ && claude mcp list
demo: https://<oauth-mcp-server>/mcp (HTTP) - ! Needs authentication

Steps to Reproduce

1. claude mcp add --scope user --transport http demo https://<oauth-mcp-server>/mcp and authenticate via /mcp.
2. In some directory: claude mcp add --scope local --transport http demo https://<oauth-mcp-server>/mcp (identical config).
3. claude mcp list → demo … ✔ Connected.
4. In that directory: claude mcp remove demo -s local.
5. claude mcp list from ~ → demo … ! Needs authentication. The demo|<hash> entry is gone from mcpOAuth.

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Claude Code Version

2.1.295 (Claude Code)

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Other (sessions run by an agent orchestrator)

Additional Information

Found while diagnosing repeated MCP logouts across ~20 concurrent sessions. Related but different: #80422 (credentials wiped with no known trigger, possibly this one), #89321. The diagnosis was done with help from Claude Code.