MCP OAuth over http now refused (2.1.281), but error only shows as 'no from the MCP SDK'

Summary

Since updating to Claude Code 2.1.281, OAuth for a remote HTTP MCP server fails every time after the browser sign-in succeeds. Token refresh fails with the same error. Signing in to the same server with 2.1.220 works, and 2.1.281 can then use the tokens 2.1.220 obtained.

Environment

• Claude Code 2.1.281, macOS (Darwin 24.1.0), native installer
• Last working version: 2.1.220 (still present in ~/.local/share/claude/versions/)
• MCP server: ha-mcp 8.5.0 (Home Assistant custom component), HTTP transport, OAuth "Sign in with Home Assistant" mode, on the local network over plain http://
• Claude Code uses a CIMD client id (https://claude.ai/oauth/…) and a loopback redirect (http://localhost:<port>/callback)

Steps to reproduce

1. claude mcp add --transport http -s local <name> <server URL>
2. /mcp → select the server → Authenticate
3. Sign in in the browser. The page says the sign-in succeeded and the window can be closed.

Expected: the server connects.
Actual: /mcp shows Auth: ✔ but Status: failed, and claude mcp list shows "Needs authentication".

Debug log (mcp-logs-<server>, 2.1.281)

Initial auth result: REDIRECT
MCP OAuth server cleaned up
Completing auth flow with authorization code
Found client info
Returning code verifier
Found client info
Error during auth completion: no from the MCP SDK for http://<host>/<path>

The error comes about 3 ms after "Returning code verifier". The server's token endpoint receives no request at the time, so the client seems to fail before the token exchange is sent. Token refresh fails the same way:

Token expires in -67s, attempting proactive refresh
Token refresh failed: no from the MCP SDK for http://<host>/<path>

The error text itself ("no from the MCP SDK") looks like a broken or empty error message (a minified name?).

What I ruled out

• Server: the token endpoint answers correctly (307 to the backing /auth/token, then a JSON OAuth error for a dummy grant), both with curl and with Node 26's fetch.
• Stale state: it still fails after removing and re-adding the server, with no stored client info or tokens.
• Version: the same server, config and account connect fine after signing in with 2.1.220 (~/.local/share/claude/versions/2.1.220 → /mcp → Authenticate).
• Possibly related to #92839 (same log sequence, ends in a minified error name), but the Keychain entry here is 3,224 bytes, below the 4 KB limit described there.

Workaround

Sign in with 2.1.220. This probably has to be repeated each time the access token expires, because 2.1.281's refresh fails too.