[BUG] MCP OAuth complete_authentication always fails with "No OAuth flow is in progress"

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Description:

When using an HTTP-type MCP server with OAuth (e.g. Asana at https://mcp.asana.com/v2/mcp), the in-memory PKCE state generated by mcp__asana__authenticate is lost before mcp__asana__complete_authentication can
consume it.

What Should Happen?

Expected: Token is exchanged and saved to .credentials.json
Actual: "No OAuth flow is in progress for asana. Call mcp__asana__authenticate first"

Error Messages/Logs

Steps to Reproduce

Steps to reproduce:

1. Configure an MCP server with "type": "http" and "oauth" in .mcp.json
2. Call mcp__asana__authenticate — get auth URL
3. Navigate the browser to that URL (user logs in, gets redirected to localhost:8080/callback?code=...)
4. Call mcp__asana__complete_authentication with the callback URL

Expected: Token is exchanged and saved to .credentials.json
Actual: "No OAuth flow is in progress for asana. Call mcp__asana__authenticate first"

Root cause hypothesis: The OAuth PKCE state (code verifier + state param) is stored in-process memory. Any tool call between authenticate and complete_authentication — including
mcp__chrome-devtools__navigate_page — appears to clear or reset this state.

Workaround: Manually exchange the code via the token endpoint using curl with the client secret, then write the token directly into /root/.claude/.credentials.json.

Claude Model

Opus 4.6

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.110 (Claude Code)

Platform

AWS Bedrock

Operating System

Linux Docker container

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_