[BUG]

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Description
The built-in Google Workspace MCP (Cowork integration) cannot authenticate. The OAuth flow fails with Error 400: redirect_uri_mismatch before the browser even loads the consent screen.

Steps to reproduce
In Claude Code CLI, invoke any mcp__google_workspace tool (e.g. read_sheet_values)
An authorization URL is generated using redirect URI http://localhost:8001/oauth2callback
Clicking the URL shows: Error 400: redirect_uri_mismatch — You can't sign in because this app sent an invalid request
Root cause (diagnosed)
The OAuth client (29196817932-l1as0tt6k3mn2ic3i9at4e0s2crhhf70.apps.googleusercontent.com) does not have http://localhost:8001/oauth2callback registered as an authorized redirect URI in Google Cloud Console.

Secondary bug (compound symptom)
A stale python.exe process from a previous auth attempt keeps port 8001 occupied across sessions. On the next session, the MCP fails with Port 8001 is already in use on localhost. Cannot start minimal OAuth server. — masking the real redirect_uri_mismatch error. Users must manually kill the orphaned process before they can even reach the OAuth URL.

Environment
OS: Windows 11 Pro 10.0.26200
Claude Code version: 2.1.111
Shell: bash (Git Bash)
Feature: Cowork / Google Workspace MCP
Expected behavior
Google Workspace tools authenticate successfully via browser OAuth and return data.

Actual behavior
Two-layer failure:

Stale python.exe blocks port 8001 on session restart
Even after killing it, Google rejects the redirect URI with Error 400

What Should Happen?

Clicking the authorization URL should open a Google consent screen, allow the user to sign in, and successfully authenticate the Google Workspace MCP so tools like read_sheet_values return data.

Error Messages/Logs

Error 400: redirect_uri_mismatch
You can't sign in because this app sent an invalid request.

Also (on session restart, before reaching OAuth):
"Cannot initiate OAuth flow - callback server unavailable 
(Port 8001 is already in use on localhost. Cannot start minimal OAuth server.)"

Steps to Reproduce

Open Claude Code CLI on Windows
Invoke any mcp__google_workspace tool (e.g. ask Claude to read a Google Sheet)
Claude presents an authorization URL with redirect URI http://localhost:8001/oauth2callback
Click the URL
Google returns: Error 400: redirect_uri_mismatch
Bonus reproduction (stale process bug):

1. Close and reopen Claude Code without restarting
2. Try step 2 again — Claude now fails with "Port 8001 is already in use" before even generating the URL
3. Run netstat -ano | grep :8001 — a stale python.exe is holding the port from the previous session
4. Manually kill it (taskkill /PID <pid> /F) to get back to step 3

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

N/A

Claude Code Version

Claude Code CLI (Desktop App + CLI)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

The OAuth client ID embedded in the authorization URL is 29196817932-l1as0tt6k3mn2ic3i9at4e0s2crhhf70.apps.googleusercontent.com. This appears to be Anthropic's own OAuth app. The redirect URI http://localhost:8001/oauth2callback is not registered as an authorized URI for this client in Google Cloud Console — this is likely an Anthropic-side configuration issue, not a user configuration issue.

The stale python.exe process (holding port 8001) appears to be the OAuth callback server that was spawned in a previous session but never cleaned up. Claude Code should kill this process on exit or use a dynamic port with proper cleanup.