[Bug] claude.ai plugin OAuth falls back to retired /authorize endpoint for Claude design MCP

Bug Description
claude.ai plugin connector OAuth fails for the Claude design MCP.
Connecting the claude-design connector declared in a plugin's .mcp.json (https://api.anthropic.com/v1/design/mcp) opens https://api.anthropic.com/authorize?..., which returns "Sign-in endpoint retired — your client reached this page through an outdated sign-in fallback."▎
The server itself is healthy and advertises discovery correctly:
WWW-Authenticate: Bearer resource_metadata="https://api.anthropic.com/v1/design/.well-known/oauth-protected-resource", scope="user:design:read user:design:write"
and that document returns authorization_servers: [REDACTED]].

So the client is falling back to the retired global /authorize instead of using the discovered authorization server. It does carry the correct scope and resource in the query string, so it reads part of the metadata.

Possibly related: the resource metadata is served at /v1/design/.well-known/oauth-protected-resource rather than the RFC 9728 location /.well-known/oauth-protected-resource/v1/design/mcp, which 404s. A client trying only the standard path would find nothing and fall back.

The same server and URL connect successfully from Claude Code (plugin:product:claude-design … ✔ Connected), so this is specific to the claude.ai connector flow

Environment Info

• Platform: darwin
• Terminal: ghostty
• Version: 2.1.222
• Feedback ID: 379d8aae-9ecf-4db4-8e54-b777f802eed2

Errors

[]