Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix [Bug] MCP HTTP OAuth token exchange ignores authorization URL scopes, uses metadata instead [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#56887•Fetched 2026-05-07 03:42:47
View on GitHub
Comments
1
Participants
2
Timeline
6
Reactions
0
Author
felgeekpefelgeekpe
Participants
felgeekpefelgeekpegithub-actions[bot]github-actions[bot]
Timeline (top)
labeled ×5commented ×1

Error Message

[{"error":"Error: NON-FATAL: Lock acquisition failed for /Users/theuser/.local/share/claude/versions/2.1.132 (expected in multi-process scenarios)\n at I96 (/$bunfs/root/src/entrypoints/cli.js:2651:2257)\n at ZRH (/$bunfs/root/src/entrypoints/cli.js:2651:1337)\n at processTicksAndRejections (native:7:39)","timestamp":"2026-05-07T01:59:37.103Z"}]

Code Example

[{"error":"Error: NON-FATAL: Lock acquisition failed for /Users/theuser/.local/share/claude/versions/2.1.132 (expected in multi-process scenarios)\n    at I96 (/$bunfs/root/src/entrypoints/cli.js:2651:2257)\n    at ZRH (/$bunfs/root/src/entrypoints/cli.js:2651:1337)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-05-07T01:59:37.103Z"}]
RAW_BUFFERClick to expand / collapse

Bug Description Claude Code's MCP HTTP OAuth flow overrides API scopes with the auth server's metadata scopes_supported during token exchange, producing tokens without the required API permissions. Result: 403 Forbidden on every MCP call.

Repro

Connect to Function Health MCP (https://services.functionhealth.com/ai-chat/mcp).

Log trace

  1. Scopes in URL: read:action_plan read:biomarkers read:health_summary offline_access ✅
  2. Using scope from metadata: openid profile offline_access name given_name email... ❌ (overrides step 1)
  3. HTTP Connection failed: 403 Forbidden

Env

  • Claude Code 2.1.132
  • macOS arm64, Node v24.3.0

Expected

Scopes captured from authorization URL should be reused at token exchange, not replaced with the auth server's scopes_supported metadata.

Environment Info

  • Platform: darwin
  • Terminal: ghostty
  • Version: 2.1.132
  • Feedback ID: 83967865-977f-46cf-869f-e5688f0e5463

Errors

[{"error":"Error: NON-FATAL: Lock acquisition failed for /Users/theuser/.local/share/claude/versions/2.1.132 (expected in multi-process scenarios)\n    at I96 (/$bunfs/root/src/entrypoints/cli.js:2651:2257)\n    at ZRH (/$bunfs/root/src/entrypoints/cli.js:2651:1337)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-05-07T01:59:37.103Z"}]

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#pipeline error#runtime error#dependency conflict#environment setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

claude-code - 💡(How to fix) Fix [Bug] MCP HTTP OAuth token exchange ignores authorization URL scopes, uses metadata instead [1 comments, 2 participants]