[BUG] Supabase MCP OAuth fails in VSCode extension but works in terminal

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Description
Supabase MCP server authentication fails when using Claude Code via the VSCode extension, but works correctly when using Claude Code in the terminal. Both use the same configuration in ~/.claude.json.

Environment
Platform: macOS (Darwin 25.3.0)
Claude Code: VSCode extension (latest)
Claude Code terminal: works correctly

What Should Happen?

Expected Behavior

VSCode extension should handle Supabase MCP OAuth the same way the terminal does — redirecting to browser for authentication.

Error Messages/Logs

{"message":"resource: Resource must be a valid MCP endpoint"}

Steps to Reproduce

Steps to Reproduce

• Configure Supabase MCP server in ~/.claude.json:

"supabase-production": {
"type": "http",
"url": "https://mcp.supabase.com/mcp?project_ref=<project_ref>"
}

• Open Claude Code in VSCode extension
• Attempt to authenticate the Supabase MCP server
• Error appears: {"message":"resource: Resource must be a valid MCP endpoint"}
• Open Claude Code in terminal (claude CLI)
• Run /mcp — OAuth browser redirect works, authentication succeeds

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.76

Claude Code Version

2.1.75

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

VS Code integrated terminal

Additional Information

Additional Context
Initially the URL contained extra query params (&read_only=true&features=database,functions,debugging) and a trailing newline, which produced a slightly different error: {"message":"resource: Resource must be a valid MCP endpoint, : Unrecognized key(s) in object: 'read_only', 'features'"}. After cleaning the URL, the error simplified to {"message":"resource: Resource must be a valid MCP endpoint"}.

Clearing ~/.claude/mcp-needs-auth-cache.json and restarting does not resolve the issue in VSCode.
/doctor and /mcp in the extension do not trigger the OAuth browser redirect properly.

The staging Supabase MCP server (same config format, different project ref) exhibits the same behavior.

Potential Root Cause

The VSCode extension double-encodes the URL query parameter when constructing the OAuth resource parameter:

• Expected: resource=https://mcp.supabase.com/mcp?project_ref=xxx
• Actual: resource=https://mcp.supabase.com/mcp%253Fproject_ref=xxx

%253F = the ? was encoded to %3F, then the % was encoded again to %25, producing %253F. The OAuth server correctly rejects this as an invalid MCP endpoint.

Full OAuth URL observed:
https://api.supabase.com/v1/oauth/authorize?...&resource=https://mcp.supabase.com/mcp%253Fproject_ref=pzsbrsbvvjhthrxpqjbb

The terminal CLI constructs the same OAuth flow with correct encoding and succeeds.

Related Issues

• #21368 — MCP initialization race condition in VSCode (stdio servers, different root cause)