[BUG] [MCP] Claude code doesn't use the resource metadata to discover the Authorization Server
When configuring an MCP Server to return 401 and expose the resource metadata on how to authenticate clients to MCP servers. Claude code doesn't use the resource metadata to discover the Authorization Server metadata.
The first image shows the traffic of claude code when it tries to complete the MCP flow.
It queried the oauth-protected-resource endpoints, but nonetheless it continues to query for the Authorization Server in localhost, although the metadata point to another endpoint as shown in the second image.
<img width="2679" height="347" alt="Image" src="https://github.com/user-attachments/assets/14fddcf3-916c-4672-b565-d9d389620502" />
<img width="1857" height="1069" alt="Image" src="https://github.com/user-attachments/assets/cfaa787c-2e47-4ab8-898b-3b8b5805a6d8" />
The same setup works with MCP Inspector and VS Code.
Expected outcome: Claude Code uses the resource metadata to discover the authorization server.
This issue has 3 comments on GitHub. Read the full discussion on GitHub ↗