[BUG] MCP OAuth Integration Fails on Production Deployments with step=start_error

Claude Desktop MCP OAuth Integration Issue Report

Issue Summary

Claude Desktop fails to complete OAuth authentication flow with a production MCP server deployment, despite the same code working correctly on a preview deployment. The OAuth flow starts but immediately fails with step=start_error before reaching the MCP server's OAuth endpoints.

Environment Details

• Date: July 14, 2025
• Claude Desktop Version: (Please add your version)
• Operating System: macOS 15.5.0
• Browser: Google Chrome 137.0.0.0
• MCP Server: @vercel/mcp-adapter on Vercel

Working vs Non-Working Deployments

✅ WORKING - Preview Deployment

• URL: https://lifetrack-intervention-hub-git-mcp-amandeep-khuranas-projects.vercel.app/api/mcp
• Branch: mcp (now deleted)
• OAuth Flow: Completes successfully

❌ NOT WORKING - Production Deployments

1. Custom Domain: https://healthtracker.amandeep.app/api/mcp
2. Vercel Domain: https://lifetrack-intervention-hub.vercel.app/api/mcp

• OAuth Flow: Fails with step=start_error

Technical Implementation

OAuth Configuration

All deployments use identical OAuth configuration:

// OAuth endpoints discovered via .well-known
{
  "authorization_endpoint": "https://[domain]/api/oauth/authorize",
  "token_endpoint": "https://[domain]/api/oauth/token",
  "scopes_supported": ["profile", "health_data"],
  "response_types_supported": ["code"],
  "grant_types_supported": ["authorization_code", "refresh_token"]
}

OAuth Flow Architecture

1. Claude Desktop → Claude.ai proxy (/api/organizations/.../mcp/start-auth/...)
2. Claude.ai proxy → MCP server OAuth authorize endpoint
3. MCP server → Frontend auth page with Supabase OAuth
4. Supabase OAuth → Google authentication
5. Return flow back to Claude Desktop with authorization code

Evidence of the Issue

1. Vercel Logs - Production Attempts

Jul 14 17:48:17.66 GET 401 healthtracker.amandeep.app /api/mcp - No bearer token provided
Jul 14 17:48:15.54 GET 200 healthtracker.amandeep.app /.well-known/oauth-authorization-server
Jul 14 17:48:15.36 GET 200 healthtracker.amandeep.app /.well-known/oauth-authorization-server
Jul 14 17:48:15.22 GET 200 healthtracker.amandeep.app /.well-known/oauth-protected-resource
Jul 14 17:48:15.00 GET 401 healthtracker.amandeep.app /api/mcp - No bearer token provided

Key observation: Claude successfully discovers OAuth endpoints but NEVER makes a request to /api/oauth/authorize

2. Chrome Network Logs - OAuth Start Error

Request URL: https://claude.ai/api/organizations/407923f3-0ecd-4792-bb13-e253d1b30e67/mcp/start-auth/5213f762-b394-48db-99b9-0da07f1a900f

Response: HTTP/1.1 307
Location: claude://claude.ai/new?&server=5213f762-b394-48db-99b9-0da07f1a900f&step=start_error

Key observation: Claude's OAuth proxy returns step=start_error before attempting to redirect to the MCP server

3. Direct OAuth Test - Works Correctly

When testing the OAuth flow directly (bypassing Claude's proxy):

GET https://healthtracker.amandeep.app/api/oauth/authorize?client_id=claude-desktop-test&redirect_uri=http://localhost:3000/callback&state=cs6chg4hz4b&response_type=code&scope=profile+health_data

Vercel Logs:
18:32:02.30 GET 302 /api/oauth/authorize 
  → Redirecting to frontend auth with OAuth params
18:32:06.62 GET 302 /api/oauth/callback 
  → Redirecting to Claude Desktop with authorization code

Final redirect URL:
http://localhost:3000/callback?code=eyJhY2Nlc3NfdG9rZW4i...[valid JWT]...&state=cs6chg4hz4b

Result: Complete OAuth flow works perfectly, returns valid authorization code containing Supabase JWT tokens

Reproduction Steps

1. Open Claude Desktop
2. Go to Settings → Integrations → Add Custom Integration
3. Enter MCP server URL: https://healthtracker.amandeep.app/api/mcp
4. Click Add/Connect
5. Browser window opens briefly and immediately closes
6. OAuth flow fails with no authorization attempt logged on server

What We've Verified

1. ✅ OAuth endpoints are accessible and return correct metadata
2. ✅ OAuth flow works when tested directly (not through Claude proxy)
3. ✅ Supabase OAuth redirect URLs are configured correctly
4. ✅ Same code works on preview deployment
5. ✅ All environment variables are set correctly
6. ✅ No CORS issues with the endpoints
7. ✅ No OAuth attempts appear in Supabase authentication logs
8. ✅ Issue persists after clearing Claude cache and restarting
9. ✅ Both Vercel domain and custom domain exhibit same failure

Hypothesis

The issue appears to be within Claude's OAuth proxy (claude.ai/api/organizations/.../mcp/start-auth/) when handling production deployments. The proxy:

1. Successfully discovers OAuth configuration
2. Attempts to start the OAuth flow
3. Encounters an internal error (step=start_error)
4. Never redirects to the MCP server's authorize endpoint

Request for Anthropic

Please investigate why Claude's OAuth proxy fails with step=start_error for production MCP server deployments while working correctly for preview deployments. The MCP server implementation is identical in both cases.

Testing Performed

A standalone test page was created to simulate Claude Desktop's OAuth flow:

1. OAuth Discovery Test: Successfully retrieved metadata from both .well-known endpoints
2. Full OAuth Flow Test: Successfully completed entire OAuth flow returning valid authorization code
3. MCP Endpoint Test: Confirmed endpoint is accessible and returns expected 401 without authentication

All tests confirm the implementation is working correctly when accessed directly.

---

Report generated: July 14, 2025 with Claude Code