[BUG] Two OAuth HTTP MCP servers with identical URL — silent dedup exposes wrong tenant's data under the other server's name

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

.mcp.json deduplicates HTTP-type MCP server entries by url alone. This has been reported before for servers using static headers (#49372, closed/stale) and for stdio servers using env (#32393, closed/stale), but neither of those covers this variant: two OAuth-authenticated HTTP servers (no static headers/tokens at all — auth happens via the browser OAuth flow Claude Code drives per server) pointing at the same remote MCP endpoint for two different tenants/accounts of the same SaaS.

Concretely, a project .mcp.json declared:

{
  "mcpServers": {
    "atlassian-comoclub": {
      "type": "http",
      "url": "https://mcp.atlassian.com/v1/mcp"
    },
    "atlassian-hurricanestudio": {
      "type": "http",
      "url": "https://mcp.atlassian.com/v1/mcp"
    }
  }
}

Both point at Atlassian's official remote MCP server, intended to be authenticated as two different Atlassian accounts (one with access to comoclub.atlassian.net, one with access to hurricanestudio.atlassian.net).

Only one server's tools ever appeared as available (mcp__atlassian-hurricanestudio__* — atlassian-comoclub's tools never showed up in the tool list at all, with no error or warning anywhere).

Worse than plain omission: calling mcp__atlassian-hurricanestudio__getAccessibleAtlassianResources returned comoclub.atlassian.net, not hurricanestudio.atlassian.net. The single surviving connection had been authenticated as comoclub (because that's the account that happened to complete the OAuth flow), but it's exposed entirely under the atlassian-hurricanestudio server name. There is no indication anywhere that the name and the actual authenticated identity have diverged — a user calling these tools would reasonably believe they're looking at Hurricane Studio's Jira/Confluence when they're actually looking at Comoclub's.

What Should Happen?

Each named entry in mcpServers should be treated as an independent server — with its own OAuth session/token cache — regardless of whether its url matches another entry's. Server identity should be the entry key, not the URL (as also requested in #49372).

At minimum, if URL-based dedup is intentional, it should:

1. Log a visible warning that a server was skipped as a duplicate, naming both the surviving and skipped server keys.
2. Never let the OAuth identity of the surviving connection silently diverge from the server name a user configured it under.

Steps to Reproduce

1. Create a .mcp.json with two http-type MCP servers pointing at the same OAuth-based remote MCP url, no headers, different names — e.g. Atlassian's remote MCP server (https://mcp.atlassian.com/v1/mcp) as shown above, intended for two different Atlassian accounts/sites.
2. Start Claude Code in that project. Complete the OAuth flow for one server when prompted.
3. Check available tools — only one server's tools appear (e.g. mcp__atlassian-hurricanestudio__*); the other (atlassian-comoclub) is silently absent, and claude mcp list / /mcp gives no indication a second server was dropped.
4. Call a tool that reveals authenticated identity (e.g. getAccessibleAtlassianResources) on the surviving server — observe it returns the other tenant's data, silently mismatched against the server's configured name.

Related Issues

• #49372 — same root cause (URL-based dedup), reported for static-header HTTP servers, closed as stale
• #32393 — same root cause (command+args dedup ignoring env), reported for stdio servers, closed as stale

Neither covers the OAuth case, and neither documents the identity-mismatch symptom (tools silently answering under the wrong account) rather than plain server disappearance.

Claude Code Version

2.1.241

Platform

Anthropic API

Operating System

macOS 26.5.2

Terminal/Shell

zsh