[BUG] Gmail connector: all calls fail with "The caller does not have permission" despite valid OAuth grant

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Every call to the Gmail connector (MCP tool) fails with the error "The caller does not have permission" — including the simplest possible call with no parameters (list_labels).

I confirmed:

• The connector shows "Connected" in Settings > Connectors, with tool permissions set to "Always Allow"
• I fully disconnected and reconnected the Gmail connector, completing the Google OAuth consent screen each time
• On Google's own permissions page (myaccount.google.com/permissions), the "Claude Gmail Connector" has the correct scopes granted: profile info, Gmail read/compose/send, draft management, message/settings viewing
• The Google account that granted access is the same account I intend to use with Claude

Despite all of the above, every Gmail tool call (search_threads, list_labels, etc.) still fails with the same permission error.

This may be related to #59512 (server-side stale/cached OAuth token in Claude's infrastructure not refreshing correctly on reconnect), though the symptom here is a permission error rather than "Not connected". Also very similar to #47847 (closed as stale, unresolved) — read operations (search_threads, get_thread) failing despite fully confirmed OAuth scopes, with multiple other users reporting the same across several related issues.

What Should Happen?

Gmail tools should succeed given a connector marked "Connected" with tool permissions set to "Always Allow" and valid, confirmed Google OAuth scopes.

Error Messages/Logs

The caller does not have permission

Steps to Reproduce

1. Open Settings > Connectors and connect the Gmail connector, completing the Google OAuth consent screen
2. Confirm the connector shows "Connected" and its tool permissions are set to "Always Allow"
3. Call any Gmail MCP tool, e.g. list_labels() with no parameters, or search_threads(query="newer_than:1d in:inbox")
4. Observe the error: "The caller does not have permission"
5. Disconnect the Gmail connector, then reconnect it, fully completing the Google OAuth consent screen again
6. Verify on myaccount.google.com/permissions that the "Claude Gmail Connector" has the correct scopes granted (Gmail read/compose/send, drafts, message/settings viewing) under the intended account
7. Retry the same Gmail tool call — the same "The caller does not have permission" error still occurs

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

N/A - reproduced via Claude's Gmail MCP connector (web/desktop connector), not the claude CLI; claude --version is not applicable here

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other

Additional Information

This was reproduced through a browser-based Claude session using the Gmail MCP connector (Settings > Connectors), not the claude CLI directly. The environment shown as "Windows"/"Other" above reflects the underlying OS of the session, since this template doesn't have a dedicated option for the web/desktop connector surface.