MCP OAuth broken: api.anthropic.com/.well-known/oauth-authorization-server advertises decommissioned gdrive server as issuer, authorize URLs return 410 "Server Turned Down"

Summary

OAuth authentication for Anthropic-hosted MCP servers (observed with claude_design, https://api.anthropic.com/v1/design/mcp) is broken because the authorization-server discovery chain resolves to metadata belonging to the decommissioned Google Drive MCP server. Every authorize URL — including ones for freshly registered OAuth clients — returns HTTP 410 with the "Server Turned Down / Please use https://drivemcp.googleapis.com/mcp/v1 instead" page.

Environment

• Claude Code 2.1.172, macOS (darwin), personal Max plan, Denmark
• Server: claude_design → https://api.anthropic.com/v1/design/mcp (type: http)

Evidence chain (all reproducible via curl)

1. The design MCP server itself is alive and gated on auth (401, not 410):

``
$ curl -s -o /dev/null -w '%{http_code}' -X POST https://api.anthropic.com/v1/design/mcp \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","method":"initialize","id":1,...}'
401
``

1. Its protected-resource metadata points at claude.ai as the authorization server:

``
$ curl -s https://api.anthropic.com/v1/design/.well-known/oauth-protected-resource
{"resource":"https://api.anthropic.com/v1/design/mcp",
"authorization_servers":["https://claude.ai/v1/design/mcp"],
"scopes_supported":["user:design:read","user:design:write"]}
``

1. But claude.ai serves no usable authorization-server metadata at either well-known layout — both return HTML (SPA shell / Cloudflare challenge) instead of JSON:

• https://claude.ai/.well-known/oauth-authorization-server/v1/design/mcp → HTML
• https://claude.ai/v1/design/mcp/.well-known/oauth-authorization-server → Cloudflare challenge page

1. Discovery then falls back to the API root, whose metadata is the decommissioned Drive server's:

``
$ curl -s https://api.anthropic.com/.well-known/oauth-authorization-server
{"issuer":"https://api.anthropic.com/mcp/gdrive",
"authorization_endpoint":"https://api.anthropic.com/authorize", ...}
``

1. Result: every https://api.anthropic.com/authorize?... URL produced by the client returns HTTP 410 with the "Server Turned Down" page. Reproduced with two different client_ids, including a brand-new dynamic client registration after clearing all cached OAuth state (keychain + ~/.claude/keychain-backup-*), so it is not stale local client state.

Impact

• claude_design MCP server cannot be authenticated from Claude Code at all.
• Likely the same root cause as other "OAuth lands on the Drive turndown page" reports: #56348 (GitHub MCP), #51326 (Gmail MCP).
• Compounds with #69496 (Claude Code login tokens lack user:design:* scopes and the scope-upgrade endpoint 400s), leaving no working path to Claude Design from Claude Code.

Expected

Either https://claude.ai/v1/design/mcp should serve valid RFC 8414 authorization-server metadata at a well-known URL, or api.anthropic.com's root oauth-authorization-server metadata should not be the decommissioned gdrive server's document.