Microsoft 365 MCP OAuth fails - relative resource_metadata in WWW-Authenticate header

Description

The Microsoft 365 MCP connector (microsoft365.mcp.claude.com/mcp) fails to authenticate on Claude Code CLI (Windows). The OAuth flow never completes, and every attempt results in:

{"type":"error","error":{"type":"invalid_request_error","message":"code: Field required"},"request_id":"req_011CZvbNrqh3s3A3wS1SftUp"}

Gmail and Google Calendar MCP connectors authenticate and work fine on the same machine — only Microsoft 365 is affected.

Steps to reproduce

1. Run /mcp in Claude Code CLI on Windows
2. Select "claude.ai Microsoft 365"
3. OAuth flow either doesn't start or silently fails
4. Dialog dismisses, claude mcp list shows "! Needs authentication"
5. Repeated attempts all produce the same result

Root cause

It appears the WWW-Authenticate header in the 401 response from microsoft365.mcp.claude.com uses a relative resource_metadata path. The Claude Code MCP client now silently rejects relative resource_metadata URLs, so OAuth discovery never starts and the client loops on unauthenticated requests.

Suggested fix

Ensure resource_metadata is an absolute URL in the 401 response:

const proto = req.headers.get("x-forwarded-proto") ?? "https";
const host  = req.headers.get("x-forwarded-host") ?? req.headers.get("host");
const resourceMetadata = `${proto}://${host}/.well-known/oauth-protected-resource`;

return new Response(JSON.stringify({ error: "Unauthorized" }), {
  status: 401,
  headers: {
    "WWW-Authenticate":
      `Bearer realm="MCP", resource_metadata="${resourceMetadata}"`,
  },
});

Environment

• Platform: Windows 11 Pro 10.0.26200
• Claude Code CLI (latest)
• Working connectors: Gmail, Google Calendar (both authenticate fine)
• Failing connector: Microsoft 365