Claude Design MCP OAuth fails after consent with unsupported localhost callback #45418

Description

Authenticating Anthropic's Claude Design remote MCP fails after browser consent because the callback URL generated by OpenCode is rejected as an unsupported localhost/loopback redirect.

The server is imported from Claude Code configuration by oh-my-openagent@latest:

claude_design
https://api.anthropic.com/v1/design/mcp

opencode mcp list correctly reports the server as needs authentication. Running the auth command opens the browser and reaches the consent flow, but completion fails at the local callback, leaving the server unauthenticated.

This appears related to #44790. The Design MCP challenge advertises path-specific protected-resource metadata, while the generic authorization path can fall back to the wrong authorization server. Anthropic users have reported the same endpoint misrouting OAuth to a retired authorization endpoint in anthropics/claude-code#72582 and anthropics/claude-code#77620.

Expected behavior: OpenCode should complete OAuth using the authorization server advertised by the protected-resource metadata, or fail before opening the browser with a clear unsupported-provider error. It should not leave stale PKCE state after an unusable callback flow.

Plugins

oh-my-openagent@latest (imports claude_design from ~/.claude.json through Claude Code compatibility)

OpenCode version

1.18.23

Steps to reproduce

1. Configure or import this remote MCP server:

   {
     "claude_design": {
       "type": "remote",
       "url": "https://api.anthropic.com/v1/design/mcp"
     }
   }

2. Run opencode mcp list and confirm claude_design reports needs authentication.

3. Run opencode mcp auth claude_design.

4. Complete the browser consent step.

5. Observe that the localhost/loopback callback is reported as unsupported and opencode mcp auth list still reports claude_design as not authenticated.

No OAuth tokens, authorization codes, PKCE verifier, or state values are included in this report.

Screenshot and/or share link

Not included because the browser page contains account-specific OAuth state.

Related reports:

• Remote MCP OAuth: resource_metadata URL from WWW-Authenticate is ignored (origin-only RFC 9728 lookup) — breaks AWS Bedrock AgentCore runtimes #44790
• claude_design MCP OAuth misroutes to Google Drive connector install flow anthropics/claude-code#72582
• [BUG] claude mcp login for the Claude Design MCP server opens a decommissioned /authorize endpoint (HTTP 410), hanging the OAuth flow anthropics/claude-code#77620

Operating System

macOS 26.6.1 (arm64)

Terminal

Orca integrated terminal (xterm-256color, zsh)