GitLab MCP OAuth fails with "The requested scope is invalid, unknown, or malformed"

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment: Windows 11 Enterprise, Claude Code VS Code extension (and desktop app)

Note: The same GitLab MCP shows as "Connected" in the claude.ai web app, so the issue is specific to the desktop/VS Code client generating an invalid OAuth request.

What Should Happen?

GitLab OAuth flow completes and the MCP server connects.

Error Messages/Logs

GitLab returns: An error has occurred — The requested scope is invalid, unknown, or malformed.

Authorization URL Generated
https://gitlab.com/oauth/authorize?response_type=code&client_id=b60a2db485b34d85204c9bbe318de59283a3d2d16d8f98b09aef7607d34654d8&redirect_uri=https%3A%2F%2Fclaude.ai%2Fapi%2Fmcp%2Fauth_callback&code_challenge=sUtrqocJe6zlL7qDu6crN_x5WRm8SdDFZblF6W7isWM&code_challenge_method=S256&state=Rsy4tLNWaqLgfjfYDE7Edv_Lshrz5aorJj-AszM6V2I&scope=api+read_api+read_user+create_runner+manage_runner+k8s_proxy+self_rotate+mcp+mcp_orbit+read_repository+write_repository+read_registry+write_registry+read_virtual_registry+write_virtual_registry+read_observability+write_observability+ai_features+sudo+admin_mode+read_service_ping+openid+profile+email+ai_workflows+user%3A%2A

Steps to Reproduce

1. Open Claude Code in VS Code
2. Type /mcp
3. Select "claude.ai Gitlab"
4. Note: browser does not launch automatically — had to copy the authorization URL and open it manually
5. Open the URL in a browser

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

Claude Code 2.1.141

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

Suspected Cause
The OAuth request includes scopes that appear invalid or unrecognized by GitLab.com — likely one or more of: mcp, mcp_orbit, ai_workflows, user:* (wildcard).

Additional Context
The same "claude.ai Gitlab" MCP shows as Connected in the claude.ai web app, so the issue is specific to the desktop/VS Code client generating the OAuth request. The browser also does not open automatically during the /mcp flow — the URL had to be copied and opened manually.