HTTP MCP server with Bearer header fails to connect — same OAuth-discovery pattern as #46640

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

An HTTP-type MCP server configured with a static Bearer token header (no OAuth expected or configured) fails to connect. The client appears to attempt an OAuth discovery probe against the server even though only a static Authorization header was configured, and fails hard when the server's response to that probe doesn't match the expected OAuth metadata schema — instead of falling back to the configured header auth. Same failure class as #46640, but here it's reproducible via the CLI too, not just the VS Code extension.

What Should Happen?

Since the server is configured with a static Authorization header and never advertised OAuth support, the client should either skip OAuth discovery entirely for servers with pre-configured static headers, or gracefully fall back to the header auth when discovery fails — instead of hard-failing the whole connection.

Error Messages/Logs

CLI (claude mcp get clickmax):
Status: ✗ Failed to connect

VS Code extension (Claude Code for VS Code), MCP servers panel:

SDK auth failed: [
  { "expected": "string", "code": "invalid_type", "path": ["issuer"], "message": "Invalid input: expected string, received undefined" },
  { "expected": "string", "code": "invalid_type", "path": ["authorization_endpoint"], "message": "Invalid input: expected string, received undefined" },
  { "expected": "string", "code": "invalid_type", "path": ["token_endpoint"], "message": "Invalid input: expected string, received undefined" },
  { "expected": "array", "code": "invalid_type", "path": ["response_types_supported"], "message": "Invalid input: expected array, received undefined" }
]

On reconnect attempt, the raw response also fails JSON-RPC 2.0 schema validation with unrecognized keys "message", "error", "statusCode" — consistent with the server returning a generic REST error body instead of valid MCP JSON-RPC or OAuth metadata.

Environment:
- Claude Code CLI: 2.1.87
- Claude Code for VS Code extension: 2.1.218
- OS: Windows 10

Steps to Reproduce

1. Configure a project-scoped HTTP MCP server in .mcp.json with a static Bearer token header:

{
"mcpServers": {
"clickmax": {
"type": "http",
"url": "https://ai.clickmax.io/mcp",
"headers": {
"Authorization": "Bearer ${CLICKMAX_MCP_TOKEN}"
}
}
}
}

1. Set the token as an environment variable in .env (confirmed valid and active on the provider's own dashboard).
2. Run claude mcp get clickmax in a fresh terminal → Status: Failed to connect.
3. Remove and re-add the server from scratch via claude mcp remove + claude mcp add --transport http → same failure persists.
4. Open the same project in Claude Code for VS Code extension → MCP servers panel shows "Failed" with the OAuth-discovery-shaped error above.

Note: this server worked correctly ~1 week prior, with no known change to the token or the server's URL/config in the meantime.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Unknown — same install, stopped working without any known Claude Code update or config change (~1 week gap)

Claude Code Version

2.1.87 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

This bug was found while using the Claude Code for VS Code extension (v2.1.218) — same connection failure reproduces both there and in a standalone terminal with the CLI. Also note: claude mcp list / claude mcp get fail on Windows unless CLAUDE_CODE_GIT_BASH_PATH is set manually, which is a separate minor issue but relevant context for reproducing on Windows.