OAuth-backed MCP connectors have no re-authenticate action — only disconnect/reconnect works, across Claude Code, Desktop, mobile, and web

Summary

Custom remote MCP connectors that use OAuth (e.g. a self-hosted server added via "Add custom connector") have no way to re-trigger the OAuth authorization flow once the token expires or becomes invalid. The only actions exposed in the connector management UI are Disconnect and Refresh tools — neither re-authenticates. "Refresh tools" only re-syncs the tool list against the existing (expired) token, so it silently no-ops when the token itself is the problem.

Steps to reproduce

1. Add a custom remote MCP connector with OAuth (e.g. https://<host>/mcp) via claude.ai web console or Claude Desktop.
2. Let the connector's token expire or otherwise become invalid.
3. In claude mcp list (Claude Code CLI), the server still reports "✔ Connected" — this appears to only check endpoint reachability, not token validity.
4. In a Claude Code session, none of the connector's tools are exposed; a system message correctly confirms the server needs authentication.
5. In claude.ai web console and Claude Desktop's connector settings, the only available actions are "Disconnect" and "Refresh tools." Refresh tools does not resolve the auth failure.
6. The only working fix is to disconnect and then reconnect the same connector. This isn't a full re-add from scratch (connector config/URL is retained) — reconnecting still re-triggers OAuth. But it's an unnecessary extra step compared to a single "re-authenticate" action that skips the disconnect entirely.

Impact

• Confusing UX: "Refresh tools" implies it should fix a stale/broken connection, but it doesn't touch auth.
• Disconnect-then-reconnect works but is an avoidable extra step for what's conceptually a one-click re-auth — the connector shouldn't need to be torn down at all just to refresh a token.
• The system already knows the token is invalid — a Claude Code session correctly detects it and lists the server under "requires authentication." But claude mcp list and the connector UI don't surface that same signal; they report "Connected" based on reachability alone, not auth validity. The failure is being trapped somewhere in the stack already, just not propagated to the status the user actually looks at.
• Affects every surface that shares connector state: Claude Code (CLI), Claude Desktop, and (by report) the mobile and web apps — none currently expose a direct "re-authenticate" action.

Suggested fix

Add an explicit "Re-authenticate" / "Reconnect" action for OAuth-backed connectors that re-runs the authorization flow in place, without requiring disconnect + reconnect. Just as important: surface the expired/invalid-token state accurately wherever connector status is shown (claude mcp list, claude.ai web console, Claude Desktop, mobile) — report it as "Needs re-authentication" or "Unavailable," not "Connected." The underlying detection already exists (a Claude Code session correctly withholds the connector's tools and reports the auth requirement); connector status displays should read from that same signal instead of a separate reachability check.

🤖 Generated with Claude Code