[BUG] Claude iOS app MCP client does not follow OAuth discovery flow — loops unauthenticated GET /mcp

Description

When connecting the Claude iOS app to a remote MCP server that requires OAuth 2.1 authentication (per MCP spec 2025-03-26), the iOS client repeatedly sends unauthenticated GET /mcp requests and receives 401 responses, but never follows the WWW-Authenticate header to complete OAuth discovery.

Expected behavior

1. Client sends GET /mcp → receives 401 with WWW-Authenticate: Bearer resource_metadata="https://example.com/.well-known/oauth-protected-resource"
2. Client fetches the resource_metadata URL → discovers authorization_servers
3. Client fetches AS metadata (/.well-known/oauth-authorization-server) → discovers authorization_endpoint, token_endpoint, registration_endpoint
4. Client performs dynamic client registration + authorization code flow
5. Client retries with a valid Bearer token

Actual behavior

The iOS client loops on step 1 indefinitely. No requests to /.well-known/oauth-protected-resource or /.well-known/oauth-authorization-server are ever observed in server logs. Meanwhile, the Claude backend (Claude-User user-agent) successfully authenticates and executes MCP tool calls via POST.

Server logs showing the pattern

49.207.x.x - - "GET /mcp HTTP/1.1" 401 78 "Claude/22792454969 CFNetwork/3860.400.51 Darwin/25.3.0"
160.79.x.x - - "POST /mcp HTTP/1.1" 200 155 "Claude-User"      <-- works fine
49.207.x.x - - "GET /mcp HTTP/1.1" 401 78 "Claude/22792454969 CFNetwork/3860.400.51 Darwin/25.3.0"
160.79.x.x - - "POST /mcp HTTP/1.1" 200 926 "Claude-User"      <-- works fine
49.207.x.x - - "GET /mcp HTTP/1.1" 401 78 "Claude/22792454969 CFNetwork/3860.400.51 Darwin/25.3.0"

The pattern repeats every ~4-6 seconds during active tool use. The 49.207.x.x IP is the iOS device; 160.79.x.x is Anthropic's backend (Claude-User user-agent).

Server response headers (verified correct)

HTTP/2 401
WWW-Authenticate: Bearer resource_metadata="https://<host>/.well-known/oauth-protected-resource"

The resource_metadata URL is an absolute URI per RFC 9728. Fetching it returns valid Protected Resource Metadata with authorization_servers. The AS metadata endpoint returns valid RFC 8414 metadata with all required fields including registration_endpoint, authorization_endpoint, token_endpoint, and grant_types_supported: ["authorization_code", "refresh_token"].

Environment

• Claude iOS app — User-Agent: Claude/22792454969 CFNetwork/3860.400.51 Darwin/25.3.0
• MCP transport: Streamable HTTP (/mcp endpoint)
• Auth: OAuth 2.1 with Auth0 as Authorization Server, dynamic client registration enabled
• Server: Java 21 / Dropwizard with MCP Java SDK servlet transports, deployed on Railway

Notes

• Tool calls through the Claude backend (Claude-User) work correctly — the iOS user can use MCP tools. The issue is only with the iOS app's direct GET /mcp connection (likely for SSE streaming).
• This may be related to #26917 (OAuth servers silently failing) and #11585 (no browser auth flow triggered), but those issues are about Claude Code CLI/Desktop. This specifically affects the Claude iOS app's MCP client.