HTTP MCP OAuth: complete_authentication fails with 'no flow in progress' — callback server dies between tool calls

Summary

When authenticating an HTTP MCP server (e.g. google-gmail) via the CLI OAuth flow, complete_authentication consistently fails with:

No OAuth flow is in progress for google-gmail. Call mcp__google-gmail__authenticate first, then retry with the callback URL.

This happens even when the callback URL is pasted back immediately in the same conversation turn. The browser shows a successful Google authorization, but the token is never persisted.

Steps to Reproduce

1. Configure an HTTP MCP server with OAuth in ~/.claude.json:

"google-gmail": {
  "type": "http",
  "url": "https://gmailmcp.googleapis.com/mcp/v1",
  "oauth": {
    "clientId": "...",
    "clientSecret": "..."
  }
}

1. In a Claude Code CLI session, call mcp__google-gmail__authenticate (or equivalent for another server)
2. Open the returned authorization URL in a browser
3. Complete Google OAuth — browser shows connection error on redirect (expected)
4. Copy the full localhost callback URL from the browser address bar
5. Paste it back into Claude and call mcp__google-gmail__complete_authentication with that URL

Expected Behavior

complete_authentication exchanges the code for a token and persists it. The MCP server becomes available.

Actual Behavior

complete_authentication returns:

No OAuth flow is in progress for google-gmail. Call mcp__google-gmail__authenticate first, then retry with the callback URL.

The flow state is lost between the authenticate and complete_authentication tool calls. The mcp-needs-auth-cache.json continues to list the server as needing auth.

Root Cause (suspected)

The local callback HTTP server spun up by authenticate appears to shut down before complete_authentication is called, and the in-memory OAuth flow state (including the PKCE code verifier) is also lost between tool calls. This makes the paste-back flow impossible to complete in the CLI.

Environment

• Claude Code: 2.1.220
• macOS: 26.6 (Build 25G72), arm64
• Shell: zsh
• MCP server type: HTTP with OAuth (google-gmail, google-drive, google-calendar)

Impact

Users are completely unable to authenticate HTTP MCP servers via the CLI OAuth flow. The loop is: authenticate → browser auth succeeds → paste callback URL → complete_authentication fails → repeat indefinitely. There is no workaround available from within the CLI.

Workaround Request

A workaround (e.g. manually injecting a token, using ADC, or a fix in the desktop app) would be appreciated in the interim.