Claude Design MCP server: FIRST_PARTY_AUTH_REJECTED (HTTP 403) despite plugin being installed

Description

The claude-design MCP server fails to connect with a 403 error, even though the Design plugin (by Anthropic) shows as installed on my claude.ai account (Settings > Plugins), and I have re-authenticated via /login.

Error

claude-design (FIRST_PARTY_AUTH_REJECTED): "api.anthropic.com rejected your claude.ai login for Claude Design (HTTP 403), most likely because a /login token carries no Claude Design access. Run /design-login and retry, or check that your accoun..."

Steps to reproduce

1. Install the "Design" plugin (Anthropic, 7 skills) via claude.ai > Settings > Plugins.
2. In Claude Code CLI, run /mcp — claude-design shows as failed to connect with the 403 above.
3. Run /login and successfully re-authenticate.
4. Run /mcp again — same 403 error persists.

Problem

The error message instructs the user to run /design-login, but no such command exists in Claude Code. There appears to be no way to resolve this from the CLI. This suggests the OAuth token issued to the Claude Code CLI session does not carry the Claude Design entitlement, even though the plugin is enabled on the account — likely an account/entitlement scope mismatch between claude.ai and the CLI's OAuth flow, not a session-level auth issue.

Expected behavior

Either:

• The CLI's login token should carry Claude Design access when the plugin is installed on the account, or
• A real command/flow should exist to grant/refresh that specific entitlement (the referenced /design-login should exist, or the error should point to a real remediation step).

Environment

• Claude Code CLI
• macOS (Darwin 25.6.0)