[BUG] Claude Mac App MCP connector fires duplicate OAuth flows on add/reconnect — causes "Authorization with the MCP server failed" popup

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When adding or toggling a custom MCP connector in Settings → MCP, the Claude Mac app initiates two simultaneous OAuth 2.1 authorization flows. The first flow completes successfully. The second flow's callback is rejected by the Anthropic backend, causing the app to display "Authorization with the MCP server failed" even though authentication actually succeeded.

Server-side OAuth logs confirm two GET /oauth/authorize requests arrive within milliseconds of each other every time a connector is added or re-toggled.

Claude Mac App Version: Claude 1.1.9493 (b58a0b) 2026-03-29T03:33:07.000Z

What Should Happen?

Only one OAuth authorization flow should be initiated per connector add or toggle action.
The connector should connect successfully without an error popup.

Error Messages/Logs

Popup message: "Authorization with the MCP server failed"

OAuth server log evidence (two requests, milliseconds apart):
[timestamp] GET /oauth/authorize?client_id=...&state=ABC...
[timestamp] GET /oauth/authorize?client_id=...&state=XYZ...  ← duplicate, different state

Steps to Reproduce

Claude Mac App Version: Claude 1.1.9493 (b58a0b) 2026-03-29T03:33:07.000Z

1. In Settings → MCP, add a custom MCP connector with OAuth authentication
2. Complete the OAuth consent flow in the browser
3. Observe "Authorization with the MCP server failed" popup in the Mac app
4. The connector may show as failed despite the OAuth handshake succeeding server-side

Alternatively: toggle an existing OAuth-authenticated MCP connector off, then back on. The popup appears on nearly every reconnect.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.81

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Claude Mac App Version: Claude 1.1.9493 (b58a0b) 2026-03-29T03:33:07.000Z

Workaround implemented server-side: suppress duplicate flows by tracking lastSuccessfulAuthTime and auto-approving any second authorize request within a 300-second window. This confirms the bug is in the client (Mac app), not the OAuth server.

The two flows have different state parameters, confirming the app is generating independent parallel flows rather than retrying a single flow.