›_ Claude Code Issues
Claude Code Issues / #56348

[BUG] mcp__github__authenticate emits an OAuth URL that redirects to a turned-down Google Drive MCP install page

Resolved 💬 3 comments Opened May 5, 2026 by jonathanmanton Closed May 5, 2026

Preflight Checklist

  • [x] I have searched existing issues and this hasn't been reported yet
  • [x] This is a single bug report (please file separate reports for different bugs)
  • [x] I am using the latest version of Claude Code

What's Wrong?

Summary

The mcp__github__authenticate tool — which is supposed to start an OAuth flow to authorise the GitHub MCP server — returns an api.anthropic.com/authorize URL whose client_id is registered against the deprecated Google Drive MCP server. Following the URL 302-redirects to api.anthropic.com/mcp/gdrive/google/install, which returns HTTP 410 Gone with a "Server Turned Down" page that asks the user to install Google Drive via the Claude directory.

Net effect: the GitHub MCP cannot be (re)authorised from inside a Claude Code session that has lost authorisation. The user is told by Anthropic's own auth server to install Google Drive, when they intended to grant GitHub access. This is confusing, looks like a phishing or mis-routed flow, and risks users either bailing out (and being unable to use the GitHub MCP) or — should the gdrive endpoint ever return 200 again — actually authorising the wrong thing.

Environment

  • Claude Code: web-hosted session on claude-opus-4-7
  • Platform: linux sandbox; browser is Chrome 147 / Windows 10
  • Date observed: 2026-05-05, ~15:58 UTC
  • MCP server: built-in github MCP (47 tools)
  • Trigger context: a system reminder announced "47 deferred tools are no longer available (MCP server disconnected): mcp__github__* (47)" and exposed only mcp__github__authenticate and mcp__github__complete_authentication via ToolSearch. Calling mcp__github__authenticate produced the broken URL.

Steps to reproduce

  1. In a Claude Code session, get the github MCP server into a "needs reauthorisation" state (or trigger the auth flow directly).
  2. Invoke mcp__github__authenticate (no arguments).
  3. Open the URL it returns in a browser.

Expected behaviour

Browser lands on an Anthropic OAuth consent page asking the user to grant access to the GitHub MCP server. After authorising, the browser is redirected to http://localhost:<port>/callback?code=...&state=... (which then fails to load — that is documented and expected for sandboxed sessions).

Actual behaviour

Browser lands at api.anthropic.com/authorize?...&client_id=<id>&..., which 302-redirects to api.anthropic.com/mcp/gdrive/google/install?metadata=<hash>, which returns HTTP 410 Gone with the body:

# Server Turned Down This MCP server has been turned down. Please use https://drivemcp.googleapis.com/mcp/v1 instead — connect via Google Drive in the Claude directory.

i.e., the OAuth client_id minted by mcp__github__authenticate for the github MCP server resolves to a Google Drive install metadata record.

Reproducibility

Deterministic. Two consecutive invocations of mcp__github__authenticate in the same session produced two different client_ids, both redirecting to the gdrive turned-down page:

| Attempt | client_id |
|---|---|
| 1 | a39cd6e4-975d-4482-8575-335ed1acae01 |
| 2 | 3e2db365-87f5-47a8-9b0e-a82e01526c31 |

Evidence

Authorize URL emitted by the tool (attempt 2)

https://api.anthropic.com/authorize?response_type=code&client_id=3e2db365-87f5-47a8-9b0e-a82e01526c31&code_challenge=yDUXC5rUuTF-Kf9MhUGMqzvQjVBLuvFI9960xErBI54&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A55563%2Fcallback&state=PzFFsjFd6cjMLqu0sEOc9dU7IOd9V8no784op4IZ7ks

HAR — request 1 (the authorize URL)

GET https://api.anthropic.com/authorize?response_type=code&client_id=3e2db365-87f5-47a8-9b0e-a82e01526c31&...

→ HTTP/2 302
   location: https://api.anthropic.com/mcp/gdrive/google/install?metadata=0ea04a71d347974423563ccde2e28ebe114016c6903eb0cf522cc48ee5d884e3
   cache-control: no-store
   cf-ray: 9f70f2502d53eafb-ORD
   x-envoy-upstream-service-time: 20
   server: cloudflare

HAR — request 2 (the redirect target)

GET https://api.anthropic.com/mcp/gdrive/google/install?metadata=0ea04a71d347974423563ccde2e28ebe114016c6903eb0cf522cc48ee5d884e3

→ HTTP/2 410
   content-type: text/html; charset=utf-8
   cf-ray: 9f70f2509e91eafb-ORD
   server: cloudflare

<!DOCTYPE html>
<html>
<head><title>Server Turned Down</title></head>
<body style="font-family: -apple-system, system-ui, sans-serif; max-width: 560px; margin: 4em auto; padding: 0 1em; color: #1f2937;">
  <h1>Server Turned Down</h1>
  <p>This MCP server has been turned down.</p>
  <p>Please use <code>https://drivemcp.googleapis.com/mcp/v1</code> instead —
    connect via <a href="https://claude.ai/directory/connectors/google-drive-drivemcp">Google Drive in the Claude directory</a>.</p>
</body>
</html>

Earlier attempt (different client_id, same outcome)

Attempt 1's client_id=a39cd6e4-975d-4482-8575-335ed1acae01 produced an identical redirect chain to the same gdrive Server Turned Down page (observed via browser screenshot rather than HAR).

Impact

  1. GitHub MCP authentication is broken from inside Claude Code. When the GitHub MCP loses its session, mcp__github__authenticate cannot recover it. Users are stuck unless the MCP reconnects spontaneously (which it sometimes does mid-session — that's how the session that produced this report eventually completed — but it is not guaranteed).
  2. User-experience hazard. Users invoking what they believe is "GitHub authentication" are shown a Google Drive page that asks them to install/authorise something else. Even though the gdrive endpoint currently returns 410, this is alarming and makes the flow feel like a security incident or a misrouted phishing attempt.
  3. Latent risk. If the gdrive install endpoint is ever reactivated (or if a similar flow is rebuilt with a 200 response), this bug would silently authorise Google Drive in place of GitHub. The fact that the routing is wrong should be fixed regardless of the current 410 masking the worst case.

Hypothesis / suggested area to investigate

The OAuth client_ids that mcp__github__authenticate mints are resolving — on api.anthropic.com/authorize — to install metadata associated with the deprecated Google Drive MCP, not the github MCP. Two possibilities:

  • The auth server's client_id → install-metadata table is mis-mapped (e.g., a default fallback that points at gdrive for any unrecognised MCP).
  • The mcp__github__authenticate tool is requesting client registration with the wrong product identifier.

Suggested fix: trace the client_id-to-install-metadata mapping for clients minted by mcp__github__authenticate, and ensure it points at the github MCP's install metadata (or, if there is no canonical install page for the built-in github MCP, that the authorize endpoint serves a real consent page rather than redirecting to an install page at all).

Workaround

None reliable. The GitHub MCP sometimes reconnects on its own mid-session — when this happens, the 47 mcp__github__* tools come back and the session can continue without going through mcp__github__authenticate. If reconnection does not happen, the session is effectively stuck.

What Should Happen?

Browser lands on an Anthropic OAuth consent page asking the user to grant access to the GitHub MCP server. After authorising, the browser is redirected to http://localhost:<port>/callback?code=...&state=... (which then fails to load — that is documented and expected for sandboxed sessions).

Error Messages/Logs

{
  "log": {
    "version": "1.2",
    "creator": {
      "name": "WebInspector",
      "version": "537.36"
    },
    "pages": [
      {
        "startedDateTime": "2026-05-05T15:58:25.188Z",
        "id": "page_1",
        "title": "https://api.anthropic.com/authorize?response_type=code&client_id=3e2db365-87f5-47a8-9b0e-a82e01526c31&code_challenge=yDUXC5rUuTF-Kf9MhUGMqzvQjVBLuvFI9960xErBI54&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A55563%2Fcallback&state=PzFFsjFd6cjMLqu0sEOc9dU7IOd9V8no784op4IZ7ks",
        "pageTimings": {
          "onContentLoad": 163.8819999061525,
          "onLoad": 164.34799996204674
        }
      }
    ],
    "entries": [
      {
        "_initiator": {
          "type": "other"
        },
        "_priority": "VeryHigh",
        "_resourceType": "document",
        "cache": {},
        "connection": "443",
        "request": {
          "method": "GET",
          "url": "https://api.anthropic.com/authorize?response_type=code&client_id=3e2db365-87f5-47a8-9b0e-a82e01526c31&code_challenge=yDUXC5rUuTF-Kf9MhUGMqzvQjVBLuvFI9960xErBI54&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A55563%2Fcallback&state=PzFFsjFd6cjMLqu0sEOc9dU7IOd9V8no784op4IZ7ks",
          "httpVersion": "http/2.0",
          "headers": [
            {
              "name": ":authority",
              "value": "api.anthropic.com"
            },
            {
              "name": ":method",
              "value": "GET"
            },
            {
              "name": ":path",
              "value": "/authorize?response_type=code&client_id=3e2db365-87f5-47a8-9b0e-a82e01526c31&code_challenge=yDUXC5rUuTF-Kf9MhUGMqzvQjVBLuvFI9960xErBI54&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A55563%2Fcallback&state=PzFFsjFd6cjMLqu0sEOc9dU7IOd9V8no784op4IZ7ks"
            },
            {
              "name": ":scheme",
              "value": "https"
            },
            {
              "name": "accept",
              "value": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"
            },
            {
              "name": "accept-encoding",
              "value": "gzip, deflate, br, zstd"
            },
            {
              "name": "accept-language",
              "value": "en-US,en;q=0.9"
            },
            {
              "name": "priority",
              "value": "u=0, i"
            },
            {
              "name": "sec-ch-ua",
              "value": "\"Google Chrome\";v=\"147\", \"Not.A/Brand\";v=\"8\", \"Chromium\";v=\"147\""
            },
            {
              "name": "sec-ch-ua-mobile",
              "value": "?0"
            },
            {
              "name": "sec-ch-ua-platform",
              "value": "\"Windows\""
            },
            {
              "name": "sec-fetch-dest",
              "value": "document"
            },
            {
              "name": "sec-fetch-mode",
              "value": "navigate"
            },
            {
              "name": "sec-fetch-site",
              "value": "none"
            },
            {
              "name": "sec-fetch-user",
              "value": "?1"
            },
            {
              "name": "upgrade-insecure-requests",
              "value": "1"
            },
            {
              "name": "user-agent",
              "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36"
            }
          ],
          "queryString": [
            {
              "name": "response_type",
              "value": "code"
            },
            {
              "name": "client_id",
              "value": "3e2db365-87f5-47a8-9b0e-a82e01526c31"
            },
            {
              "name": "code_challenge",
              "value": "yDUXC5rUuTF-Kf9MhUGMqzvQjVBLuvFI9960xErBI54"
            },
            {
              "name": "code_challenge_method",
              "value": "S256"
            },
            {
              "name": "redirect_uri",
              "value": "http%3A%2F%2Flocalhost%3A55563%2Fcallback"
            },
            {
              "name": "state",
              "value": "PzFFsjFd6cjMLqu0sEOc9dU7IOd9V8no784op4IZ7ks"
            }
          ],
          "cookies": [],
          "headersSize": -1,
          "bodySize": 0
        },
        "response": {
          "status": 302,
          "statusText": "",
          "httpVersion": "http/2.0",
          "headers": [
            {
              "name": "cache-control",
              "value": "no-store"
            },
            {
              "name": "cf-cache-status",
              "value": "DYNAMIC"
            },
            {
              "name": "cf-ray",
              "value": "9f70f2502d53eafb-ORD"
            },
            {
              "name": "content-security-policy",
              "value": "default-src 'none'; frame-ancestors 'none'"
            },
            {
              "name": "content-type",
              "value": "text/html; charset=utf-8"
            },
            {
              "name": "date",
              "value": "Tue, 05 May 2026 15:58:25 GMT"
            },
            {
              "name": "location",
              "value": "https://api.anthropic.com/mcp/gdrive/google/install?metadata=0ea04a71d347974423563ccde2e28ebe114016c6903eb0cf522cc48ee5d884e3"
            },
            {
              "name": "ratelimit-limit",
              "value": "100"
            },
            {
              "name": "ratelimit-policy",
              "value": "100;w=900"
            },
            {
              "name": "ratelimit-remaining",
              "value": "99"
            },
            {
              "name": "ratelimit-reset",
              "value": "900"
            },
            {
              "name": "server",
              "value": "cloudflare"
            },
            {
              "name": "server-timing",
              "value": "x-originResponse;dur=22"
            },
            {
              "name": "strict-transport-security",
              "value": "max-age=31536000; includeSubDomains"
            },
            {
              "name": "vary",
              "value": "Accept"
            },
            {
              "name": "x-content-type-options",
              "value": "nosniff"
            },
            {
              "name": "x-envoy-upstream-service-time",
              "value": "20"
            },
            {
              "name": "x-frame-options",
              "value": "SAMEORIGIN"
            },
            {
              "name": "x-powered-by",
              "value": "Express"
            },
            {
              "name": "x-robots-tag",
              "value": "none"
            }
          ],
          "cookies": [],
          "content": {
            "size": 0,
            "mimeType": "text/html"
          },
          "redirectURL": "https://api.anthropic.com/mcp/gdrive/google/install?metadata=0ea04a71d347974423563ccde2e28ebe114016c6903eb0cf522cc48ee5d884e3",
          "headersSize": -1,
          "bodySize": -1,
          "_transferSize": 182,
          "_error": null,
          "_fetchedViaServiceWorker": false
        },
        "serverIPAddress": "160.79.104.10",
        "startedDateTime": "2026-05-05T15:58:25.184Z",
        "time": 75.94699994660914,
        "timings": {
          "blocked": 5.410999936044217,
          "dns": -1,
          "ssl": -1,
          "connect": -1,
          "send": 0.502,
          "wait": 68.06299990355969,
          "receive": 1.9710001070052385,
          "_blocked_queueing": 4.302999936044216,
          "_workerStart": -1,
          "_workerReady": -1,
          "_workerFetchStart": -1,
          "_workerRespondWithSettled": -1
        },
        "_connectionId": "2075930",
        "pageref": "page_1"
      },
      {
        "_initiator": {
          "type": "other"
        },
        "_priority": "VeryHigh",
        "_resourceType": "document",
        "cache": {},
        "connection": "443",
        "request": {
          "method": "GET",
          "url": "https://api.anthropic.com/mcp/gdrive/google/install?metadata=0ea04a71d347974423563ccde2e28ebe114016c6903eb0cf522cc48ee5d884e3",
          "httpVersion": "http/2.0",
          "headers": [
            {
              "name": ":authority",
              "value": "api.anthropic.com"
            },
            {
              "name": ":method",
              "value": "GET"
            },
            {
              "name": ":path",
              "value": "/mcp/gdrive/google/install?metadata=0ea04a71d347974423563ccde2e28ebe114016c6903eb0cf522cc48ee5d884e3"
            },
            {
              "name": ":scheme",
              "value": "https"
            },
            {
              "name": "accept",
              "value": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"
            },
            {
              "name": "accept-encoding",
              "value": "gzip, deflate, br, zstd"
            },
            {
              "name": "accept-language",
              "value": "en-US,en;q=0.9"
            },
            {
              "name": "priority",
              "value": "u=0, i"
            },
            {
              "name": "sec-ch-ua",
              "value": "\"Google Chrome\";v=\"147\", \"Not.A/Brand\";v=\"8\", \"Chromium\";v=\"147\""
            },
            {
              "name": "sec-ch-ua-mobile",
              "value": "?0"
            },
            {
              "name": "sec-ch-ua-platform",
              "value": "\"Windows\""
            },
            {
              "name": "sec-fetch-dest",
              "value": "document"
            },
            {
              "name": "sec-fetch-mode",
              "value": "navigate"
            },
            {
              "name": "sec-fetch-site",
              "value": "none"
            },
            {
              "name": "sec-fetch-user",
              "value": "?1"
            },
            {
              "name": "upgrade-insecure-requests",
              "value": "1"
            },
            {
              "name": "user-agent",
              "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36"
            }
          ],
          "queryString": [
            {
              "name": "metadata",
              "value": "0ea04a71d347974423563ccde2e28ebe114016c6903eb0cf522cc48ee5d884e3"
            }
          ],
          "cookies": [],
          "headersSize": -1,
          "bodySize": 0
        },
        "response": {
          "status": 410,
          "statusText": "",
          "httpVersion": "http/2.0",
          "headers": [
            {
              "name": "access-control-allow-credentials",
              "value": "true"
            },
            {
              "name": "cf-cache-status",
              "value": "DYNAMIC"
            },
            {
              "name": "cf-ray",
              "value": "9f70f2509e91eafb-ORD"
            },
            {
              "name": "content-security-policy",
              "value": "default-src 'none'; frame-ancestors 'none'"
            },
            {
              "name": "content-type",
              "value": "text/html; charset=utf-8"
            },
            {
              "name": "date",
              "value": "Tue, 05 May 2026 15:58:25 GMT"
            },
            {
              "name": "server",
              "value": "cloudflare"
            },
            {
              "name": "server-timing",
              "value": "x-originResponse;dur=5"
            },
            {
              "name": "strict-transport-security",
              "value": "max-age=31536000; includeSubDomains"
            },
            {
              "name": "vary",
              "value": "Origin"
            },
            {
              "name": "x-content-type-options",
              "value": "nosniff"
            },
            {
              "name": "x-envoy-upstream-service-time",
              "value": "3"
            },
            {
              "name": "x-frame-options",
              "value": "SAMEORIGIN"
            },
            {
              "name": "x-powered-by",
              "value": "Express"
            },
            {
              "name": "x-robots-tag",
              "value": "none"
            }
          ],
          "cookies": [],
          "content": {
            "size": 509,
            "mimeType": "text/html",
            "text": "<!DOCTYPE html>\n<html>\n<head><title>Server Turned Down</title></head>\n<body style=\"font-family: -apple-system, system-ui, sans-serif; max-width: 560px; margin: 4em auto; padding: 0 1em; color: #1f2937;\">\n  <h1>Server Turned Down</h1>\n  <p>This MCP server has been turned down.</p>\n  <p>Please use <code>https://drivemcp.googleapis.com/mcp/v1</code> instead —\n    connect via <a href=\"https://claude.ai/directory/connectors/google-drive-drivemcp\">Google Drive in the Claude directory</a>.</p>\n</body>\n</html>"
          },
          "redirectURL": "",
          "headersSize": -1,
          "bodySize": -1,
          "_transferSize": 569,
          "_error": null,
          "_fetchedViaServiceWorker": false
        },
        "serverIPAddress": "160.79.104.10",
        "startedDateTime": "2026-05-05T15:58:25.260Z",
        "time": 73.15400009974837,
        "timings": {
          "blocked": 0.9309999753534794,
          "dns": -1,
          "ssl": -1,
          "connect": -1,
          "send": 0.16099999999999998,
          "wait": 71.57000010335446,
          "receive": 0.4920000210404396,
          "_blocked_queueing": 0.4859999753534794,
          "_workerStart": -1,
          "_workerReady": -1,
          "_workerFetchStart": -1,
          "_workerRespondWithSettled": -1
        },
        "_connectionId": "2075930",
        "pageref": "page_1"
      }
    ]
  }
}

Steps to Reproduce

Deterministic. Two consecutive invocations of mcp__github__authenticate in the same session produced two different client_ids, both redirecting to the gdrive turned-down page:

| Attempt | client_id |
|---|---|
| 1 | a39cd6e4-975d-4482-8575-335ed1acae01 |
| 2 | 3e2db365-87f5-47a8-9b0e-a82e01526c31 |

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude 1.5354.0 (9a9e3d) 2026-04-29T01:14:34.000Z

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other

Additional Information

I am using the windows claude client in the "code" tab.

View original on GitHub ↗

This issue has 3 comments on GitHub. Read the full discussion on GitHub ↗