MCP: invalid_scope OAuth error when ?features= includes "dashboards"

Repro

When connecting to the hosted MCP server https://mcp.posthog.com/mcp with
?features= query param, adding dashboards causes the OAuth flow to fail with
error=invalid_scope on the redirect callback. Other feature combinations work.

Working scope sets (OAuth completes, MCP tools load)

• ?features=sql,data_schema
• ?features=sql,data_schema,insights

Failing scope set

• ?features=sql,data_schema,insights,dashboards
• Result: http://localhost:<port>/callback?error=invalid_scope&state=<state> (no error_description)

Account context

• PostHog Cloud US, free tier, single project (id 443630), org "Ezequiel Machado"
  (id 019e6c40-af7a-0000-8804-a3afd3a460c8). Role: organization owner.
• Client: Claude Code (CLI), OAuth client metadata
  https://claude.ai/oauth/claude-code-client-metadata.

Investigation

Inspected source:

• services/mcp/schema/tool-definitions.json lists features
  data_warehouse, debug, events, experiments, feedback, insights, llm_analytics, notebooks, replay, search, surveys, workspace — no dashboards.
• services/mcp/definitions/core.yaml has dashboard-* and dashboard-templates-*
  tools all marked enabled: false.
• products/dashboards/mcp/tools.yaml defines dashboard-create/update/delete/get/...
  with scopes dashboard:read, dashboard:write, query:read — these ARE in
  Claude Code's pre-registered OAuth scope list (visible in the failing URL's
  scope= param), so the request is otherwise valid.
• FAQ at posthog.com/docs/model-context-protocol/faq documents dashboards
  as a valid feature value.

Best guess: dashboards is documented as a public feature but its routing in
the MCP server still rejects users (maybe via feature flag, plan check, or
incomplete migration from the legacy core.yaml registry). The invalid_scope
error code is misleading — actual scope list is fine.

Expected

Either:

• ?features=dashboards succeeds for free-tier org owners and exposes
  dashboard-create / dashboard-get / dashboards-get-all tools, OR
• FAQ removes dashboards from the documented feature list until the routing
  is enabled.

Start with services/mcp/schema/tool-definitions.json, services/mcp/definitions/core.yaml, and products/dashboards/mcp/tools.yaml, then trace the OAuth feature routing for dashboards. Reproduce the failing features query and compare it with the working scope sets. Done means dashboards succeeds for the stated account context with the expected tools, or the FAQ no longer documents it as supported.