MCP OAuth: duplicate 'prompt' parameter in Microsoft 365 authorize URL

Bug Description

When attempting to authenticate with the Microsoft 365 MCP server (microsoft365.mcp.claude.com/mcp) via the legal plugin, the OAuth authorization URL contains a duplicate prompt parameter, causing Microsoft to reject the request.

Error

AADSTS9000411: The request is not properly formatted. The parameter 'prompt' is duplicated.

Reproduction

1. Install the legal plugin (knowledge-work-plugins)
2. Attempt to use any ms365 tool that triggers OAuth sign-in
3. The browser opens the Microsoft authorize URL
4. Microsoft returns error AADSTS9000411

Root Cause

The constructed authorize URL includes prompt twice:

https://login.microsoftonline.com/common/oauth2/v2.0/authorize
  ?prompt=select_account          ← first occurrence
  &response_type=code
  &client_id=08ad6f98-a4f8-4635-bb8d-f1a3044760f0
  &code_challenge=...
  &code_challenge_method=S256
  &redirect_uri=http://localhost:41086/callback
  &state=...
  &scope=api://07c030f6-5743-41b7-ba00-0a6e85f37c17/.default+offline_access
  &prompt=consent                 ← second occurrence (duplicate)

It appears the MCP server's OAuth metadata specifies prompt=select_account, and Claude Code's OAuth client then appends prompt=consent — resulting in a malformed URL that Microsoft correctly rejects per the OAuth 2.0 spec (parameters MUST NOT appear more than once).

Expected Behavior

The authorize URL should contain a single prompt parameter. Either:

• Use only prompt=consent (if re-consent is needed)
• Use only prompt=select_account (if account selection is needed)
• Merge them: prompt=select_account consent (space-separated, per Microsoft docs)

Environment

• Claude Code version: latest (as of 2026-02-06)
• OS: Windows 11
• Plugin: knowledge-work-plugins/legal v1.0.0
• MCP Server: plugin:legal:ms365 → https://microsoft365.mcp.claude.com/mcp
• Client ID: 08ad6f98-a4f8-4635-bb8d-f1a3044760f0

Workaround

None found. The OAuth URL is constructed internally by Claude Code's MCP OAuth flow — no local configuration can override the prompt parameter.