Google Workspace MCP OAuth fails with Error 400: invalid_scope

Bug Description

The built-in Google Workspace MCP server (claude.ai remote integration) fails during OAuth authorization with Error 400: invalid_scope. Google rejects the authorization request because the server includes invalid or unapproved scopes in the OAuth URL.

Steps to Reproduce

1. Start a Claude Code session with the Google Workspace MCP server enabled
2. Call any Google Workspace tool (e.g., list_calendars)
3. Server returns an authorization URL — click it to authenticate
4. Google displays: "Access blocked: Authorization Error" with Error 400: invalid_scope

Error Details

Google's error page shows:

Some requested scopes were invalid.
{valid=[...list of valid scopes...], invalid=[https://www.googleapis.com/auth/calendar.r]}
Error 400: invalid_scope

The invalid scope calendar.r appears to be a truncated or malformed version of calendar.readonly.

Environment

• Claude Code version: Latest (as of 2026-03-03)
• Platform: Linux (Pop!_OS)
• MCP server type: claude.ai remote (built-in Google Workspace integration)
• Google account: Personal Gmail account
• OAuth Client ID in the generated URL: 677404808573-1beorquhjshssfpe0qlbdaiidug9s03f.apps.googleusercontent.com

Auth Cache

The MCP auth cache at ~/.claude/mcp-needs-auth-cache.json shows:

{"claude.ai Gmail":{"timestamp":1772591010004},"claude.ai Google Calendar":{"timestamp":1772591010143}}

Expected Behavior

The OAuth flow should complete successfully, granting the MCP server access to Google Workspace APIs.

Actual Behavior

Google rejects the OAuth request due to an invalid scope in the authorization URL constructed by the MCP server.

Screenshot

The Google "Access blocked: Authorization Error" page is shown to the user with the invalid_scope details.