[BUG] VS Code extension double-encodes MCP OAuth resource parameter when server URL has a query string (still present in 2.1.280)

What's wrong

Authenticating an HTTP MCP server whose URL contains a query string fails from the VS Code extension: the generated OAuth authorize URL carries a double-encoded resource parameter, and the authorization server rejects it.

This is still happening on the latest version. It was reported before in #34880 and #69746; both were closed as inactive, not fixed, and the closing note asked to open a new issue if still relevant.

Environment

• Claude Code VS Code extension: anthropic.claude-code-2.1.280-win32-x64
• Claude Code CLI on PATH: 2.1.226
• VS Code 1.138.0
• Windows 10 Home

Config (.mcp.json, project scope)

{
  "mcpServers": {
    "supabase": {
      "type": "http",
      "url": "https://mcp.supabase.com/mcp?project_ref=<redacted>"
    }
  }
}

Steps to reproduce

1. Add the server above.
2. In the VS Code extension, run /mcp → supabase → Authenticate.
3. Open the generated authorize URL.

Actual

The resource parameter in the generated URL is:

resource=https://mcp.supabase.com/mcp%253Fproject_ref=<redacted>

%253F is ? encoded twice (? → %3F → %253F). Supabase answers:

{"message":"resource: Resource must be a valid MCP endpoint"}

Expected

resource=https://mcp.supabase.com/mcp%3Fproject_ref=<redacted>

(encoded once), and the OAuth flow completes.

Notes

• The same server without a query string (https://mcp.supabase.com/mcp, as shipped by the Supabase plugin) authenticates fine from the same extension, so the problem is specific to URLs that already contain ?.
• Per #34880 and #69746 the terminal CLI builds the URL correctly, which points to a separate OAuth URL-construction path in the extension.
• Scoping the server with project_ref is Supabase's recommended setup, so users currently have to choose between that and a working login in VS Code.