[BUG]

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary

For an MCP server configured with a confidential OAuth client (claude mcp add ... --client-secret), once the stored secret is lost — e.g. /logout clears mcpOAuthClientConfig from ~/.claude/.credentials.json — running claude mcp login <server> does not detect the missing secret and reprompt for it. It runs the full OAuth authorize/redirect flow (browser opens, local callback renders a "success" page) and only fails at the very end with:

Error during auth completion: Client authentication failed. Check that client_id and client_secret match your registered app.

This is misleading — it reads like a client_id/secret mismatch, when the real problem is that no secret is configured at all. This is fully deterministic (verified via retry, claude mcp logout+login, and plain login) — not intermittent.

Note: this is distinct from #91199 — in our case, once the secret is supplied via add --client-secret, it is correctly persisted (~/.claude/.credentials.json → mcpOAuthClientConfig["<server>|<hash>"].clientSecret) and auth succeeds. The gap is specifically that login has no path to reprompt for a secret known to be missing.

What Should Happen?

mcp login should detect an incomplete/missing client credential for a confidential-client server and prompt for the secret inline, rather than running the full flow and failing at the last step with a misleading error.

Error Messages/Logs

Steps to Reproduce

1. claude mcp add --scope user --transport http <server> <url> --client-id <id> --client-secret --callback-port <port> (enter secret), claude mcp login <server> — succeeds.
2. claude auth logout — clears mcpOAuthClientConfig (confirmed via jq '.mcpOAuthClientConfig' ~/.claude/.credentials.json → null afterward), leaves ~/.claude.json's server entry and the orphaned mcpOAuth token record intact.
3. Log back in, claude mcp login <server> — fails every time with the error above.

Claude Model

Not sure / Multiple models

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.260 (Claude Code)

Platform

AWS Bedrock

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Other

Additional Information

Workaround

The only known fix is claude mcp remove <server> followed by claude mcp add ... --client-secret (which re-prompts) and claude mcp login <server> again — there is no lighter way to just re-supply the missing secret.

Initial Finding

The initial finding happened when we switched from direct Bedrock to using claude in gateway mode (via force gateway login in managed-settings.json). This appears to also trigger the credential wipe. Further diagnostics showed that it only required a /logout command to reproduce.