[BUG] azure-devops stdio MCP server returns 401 on every call after Claude desktop update (2.110.1.0 -> 2.2553.1.0), while the same PAT works outside the app

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary

A locally configured stdio MCP server (@azure-devops/mcp, PAT auth) fails with 401 on every tool call in the Claude desktop app (Code tab). The exact same PAT returns 200 when called directly against the Azure DevOps REST API from a plain terminal. Nothing I changed on my side (token, config, processes, reboot) fixes it.

Environment

• Windows 11 Home Single Language 10.0.26200
• Claude desktop app (Microsoft Store / MSIX): 2.2553.1.0 (previous: 2.110.1.0)
• Claude CLI: <output of claude --version>
• MCP server: @azure-devops/mcp (global npm install), transport stdio
• Registered with: claude mcp add azure-devops -s user -e PERSONAL_ACCESS_TOKEN=<raw PAT> -- node ...\@azure-devops\mcp\dist\index.js <org> -d core work work-items repositories --authentication pat

Timeline (2026-09-18)

• 17/09 10:45-11:53: app updated to 2.110.1.0 (AppXDeploymentServer log).
• 18/09 11:23-12:16: app updated to 2.2553.1.0.
• Afternoon: my PAT had genuinely expired, so the first failures were legitimate ("Access Denied: The Personal Access Token used has expired", full JSON body).
• After renewing the PAT (correct scopes: Work Items R/W, Code R/W, Project and Team R), every call returns a bare "Failed request: (401)" with no body. This has not changed since.
• The AppXDeploymentServer log also shows error 0x12C ("failed to delete file") repeating every few minutes all day for WindowsApps\Deleted\Claude_2.110.1.0_x64__..., i.e. the old package's cleanup never completed.

Expected

Tool calls (core_list_projects, wit_work_item get_batch) succeed with the valid PAT.

Actual

Every call returns "Failed request: (401)". session_connectors_status reports the server as "connected" with 22 tools, so the process starts and speaks MCP fine; only its outbound Azure DevOps requests are rejected.

Evidence the token and config are correct

• Direct REST call with the same PAT (curl, and Invoke-WebRequest run by me from PowerShell): GET https://dev.azure.com/<org>/_apis/projects?api-version=7.1 -> 200.
• Config in ~/.claude.json inspected: single clean user-scope entry, PERSONAL_ACCESS_TOKEN has no whitespace or newline.
• Read @azure-devops/mcp dist/auth.js and index.js: the "pat" path expects base64(":" + PAT) for the fetch interceptor and decodes it back to the raw PAT for the WebApi handler. I tried both raw and base64-encoded values; both give 401 through the app.

Ruled out

• Expired or under-scoped PAT (regenerated; direct call returns 200)
• Malformed value (format verified)
• Duplicate or stale config entries (removed all with claude mcp remove -s local / -s user, re-added cleanly with claude mcp add -s user)
• PERSONAL_ACCESS_TOKEN, HTTP_PROXY or HTTPS_PROXY set at OS level (none)
• Stale child process (killed the node process, it respawned with a new PID)
• Stale app process (full app restart and full machine reboot)

Caveat

The timing correlates with the app update, but I cannot prove the update is the cause, because the PAT expiry happened the same day. What I can say is that the failure is specific to the process spawned by the app: same credential, same endpoint, works outside it.

Workaround

None found. I am doing the Azure DevOps work manually through the web UI.

What Should Happen?

Every call returns "Failed request: (401)". session_connectors_status reports the server as "connected" with 22 tools, so the process starts and speaks MCP fine; only its outbound Azure DevOps requests are rejected.

Error Messages/Logs

Steps to Reproduce

Direct REST call with the same PAT (curl, and Invoke-WebRequest run by me from PowerShell): GET https://dev.azure.com/<org>/_apis/projects?api-version=7.1 -> 200.

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.110.1.0

Claude Code Version

2.2553.1.0

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

_No response_