OAuth: Duplicate prompt=consent parameter in Microsoft 365 MCP authorization URL

Description

When authenticating with the Microsoft 365 MCP server (https://microsoft365.mcp.claude.com/mcp), Claude Code generates a malformed OAuth authorization URL that contains the prompt parameter twice with different values. This causes authentication to fail.

Steps to Reproduce

1. Add the Microsoft 365 MCP server:

``bash
claude mcp add --transport http microsoft365 https://microsoft365.mcp.claude.com/mcp
``

1. Run /mcp in Claude Code

1. Select the Microsoft 365 server and choose to authenticate

1. Observe the authorization URL that is generated - it contains prompt parameter twice with different values

Expected Behavior

The OAuth authorization URL should contain prompt only once with a single value:

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?prompt=select_account&...

Actual Behavior

The URL contains the prompt parameter twice with different values - once at the beginning and once at the end:

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?prompt=select_account&{other_parameters}&prompt=consent

This malformed URL with conflicting prompt values causes the Microsoft OAuth flow to fail.

Analysis

The duplicate parameter is present in the URL before clicking/opening it, indicating the issue is in Claude Code's OAuth URL construction logic. It appears:

1. The MCP server (or Microsoft's OAuth metadata) specifies prompt=select_account
2. Claude Code's OAuth handler appends prompt=consent separately
3. Both end up in the final URL, creating an invalid request

The OAuth handler should either:

• Use only the server-specified prompt value, OR
• Override/replace (not append) if Claude Code needs to enforce prompt=consent

Environment

• Claude Code version: 2.1.22
• OS: Windows
• MCP Server URL: https://microsoft365.mcp.claude.com/mcp

Workaround

None found - authentication cannot complete with conflicting prompt parameters.