Webex HTTP MCP OAuth flow fails silently — missing /v1/ prefix and scope param in authorize URL

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When connecting to the Webex MCP server (https://webexapis.com/v1/mcp) via claude mcp add --transport http --client-id ... --client-secret --callback-port ..., the OAuth authorization URL generated by authenticate is:

https://webexapis.com/authorize?response_type=code&client_id=...&code_challenge=...&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A4711%2Fcallback&state=...

This fails against Webex for two reasons:

1. Webex's actual authorize endpoint is https://webexapis.com/v1/authorize, not https://webexapis.com/authorize. Calling the latter hits Webex's API gateway instead of the OAuth authorize page, returning errors like {"message":"The request requires a valid access token...","trackingId":"ROUTERGW_..."}.

1. The generated URL omits the scope parameter entirely. Webex requires an explicit scope list matching the scopes granted to the OAuth integration (confirmed by comparing against the "OAuth Authorization URL" that Webex's own Developer Portal generates for the same integration, which includes a full scope=spark%3A... string, notably including the mandatory spark:mcp scope for MCP access). Without it, Webex returns invalid_scope: The requested scope is invalid.

After manually correcting the URL (adding /v1/ and the full scope param), the browser flow completes successfully - Webex shows a login/consent screen, and the final redirect lands on http://localhost:<port>/callback?code=...&state=... with an "Authentication successful" page.

However, even after this manual browser-side success, claude mcp get <server> and /mcp continue to report "Needs authentication", and triggering authenticate again regenerates the exact same broken (no /v1/, no scope) URL. This strongly suggests the internal token-exchange step (the POST that trades code for an access token after the callback) has the same missing /v1/ prefix and/or missing scope, so it fails silently in the background even though the browser-visible redirect succeeded.

What Should Happen?

The authenticate flow (and the internal token-exchange step) should target Webex's actual endpoints (https://webexapis.com/v1/authorize and the corresponding /v1/access_token), and should include a scope parameter matching the scopes granted to the configured OAuth integration (or otherwise handle Webex's requirement that scope be explicitly present, including spark:mcp for MCP access). On success, claude mcp get <server> and /mcp should reflect the authenticated state immediately, instead of continuing to report "Needs authentication" and regenerating the same broken URL on retry.

Error Messages/Logs

Steps to Reproduce

1. In the Webex Developer Portal, create a new OAuth Integration with scopes including spark:mcp (plus any others needed), and redirect URI http://localhost:4711/callback.

1. Run: claude mcp add --transport http --client-id <client-id> --client-secret --callback-port 4711 webex https://webexapis.com/v1/mcp (enter the client secret via MCP_CLIENT_SECRET env var or prompt).

1. Trigger authentication via /mcp -> select webex -> Authenticate (or call mcp__webex__authenticate directly).

1. Observe the generated authorize URL: it has no /v1/ prefix and no scope parameter.

1. Opening that URL as-is fails at Webex with either a gateway 401 (missing /v1/) or invalid_scope (missing scope).

1. Manually patch the URL - add /v1/ after webexapis.com and append a scope parameter with the integration's granted scopes (obtainable from the Developer Portal's own "OAuth Authorization URL" field for that integration) - and open the patched URL instead.

1. Complete login/consent in the browser; observe the "Authentication successful" page and correct redirect to localhost:4711/callback?code=...&state=....

1. Run claude mcp get webex (or check /mcp) again: status still shows "Needs authentication".

1. Trigger authenticate again: the same broken URL (no /v1/, no scope) is generated once more, with no way to persist the successful manual auth.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.223

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

The content for the various sections was provided by Claude and just copied over