Custom connector: OAuth completes (token issued, 4×) but claude.ai never calls the MCP server — "Authorization with the MCP server failed"

### What happened?

**Title:** Custom connector: OAuth completes (token issued, 4×) but claude.ai
never calls the MCP server — "Authorization with the MCP server failed"

**References:** ofid_26032ef270138c66 (2026-07-21 ~01:16-01:18 UTC),
ofid_2d781d262530d32c (2026-07-21 ~01:38 UTC)

**Server:** https://marketing.atriaveiculos.com.br/api/mcp/mcp
(streamable HTTP, stateless; OAuth 2.1 single-tenant AS on same host)

**What our access logs show (all 4 attempts, identical pattern):**
1. POST /api/mcp/mcp → 401 + WWW-Authenticate resource_metadata (probe) ✓
2. GET /.well-known/oauth-protected-resource → 200 ✓
3. GET /.well-known/oauth-authorization-server → 200 ✓
4. POST /api/oauth/register → 201 (note: registered TWICE per attempt, ~1s apart)
5. GET /authorize (PKCE S256 + resource param) → 200, user consents
6. POST /api/oauth/approve → 302 to https://claude.ai/api/mcp/auth_callback?code&state&iss
7. POST /api/oauth/token (grant_type=authorization_code, code_verifier, resource)
→ 200 in <1s: {access_token, token_type:"Bearer", expires_in:3600,
refresh_token, scope:"ads"} with Cache-Control: no-store
8. **No further request from Anthropic egress ever reaches the server.**
No POST/GET to /api/mcp/mcp with the issued token. UI shows
"Authorization with the MCP server failed" moments later.

**Server correctness evidence:** replaying step 8 ourselves from the public
internet with a token issued by the same flow returns 200 (initialize →
serverInfo) in 0.22s. No 3xx redirects on the MCP URL (HEAD/GET/POST → 401
direct). Token endpoint latency ~0.3s. AS metadata advertises S256,
authorization_response_iss_parameter_supported, response_modes ["query"].

This matches the pattern in #315 / #171. Happy to provide timestamped logs.

### What did you expect to happen?

**Expected behavior**

After the token endpoint returns 200 with a valid access token
(`{access_token, token_type: "Bearer", expires_in: 3600, refresh_token, scope}`),
claude.ai should use that token to call the MCP server — POST `initialize`
with `Authorization: Bearer ` — complete the handshake, and list
the server's tools, marking the connector as connected.

**Actual behavior**

claude.ai never contacts the MCP server again after the successful token
exchange (zero requests from Anthropic egress in our access logs, across 4
attempts), and shows "Authorization with the MCP server failed" moments later.
The same access token, replayed by us from the public internet against the same
URL, returns 200 (initialize → serverInfo) in 0.22s — so the token and the
server are demonstrably functional.

### Steps to reproduce

**Steps to Reproduce**

1. In claude.ai (web), go to Settings → Connectors → Add custom connector and
enter the MCP server URL (streamable HTTP endpoint with OAuth 2.1 + DCR).
2. claude.ai performs discovery and registration successfully:
401 probe with `WWW-Authenticate: Bearer resource_metadata=…` → GET both
`/.well-known/oauth-protected-resource` and
`/.well-known/oauth-authorization-server` (200) → POST to the
`registration_endpoint` (201 — note: claude.ai registers TWO clients per
attempt, ~1s apart).
3. Complete the interactive flow: the authorization page loads (PKCE S256
`code_challenge` and RFC 8707 `resource` param present), user logs in and
clicks approve → 302 redirect to
`https://claude.ai/api/mcp/auth_callback?code=…&state=…&iss=…`.
4. claude.ai exchanges the code: POST to the token endpoint with
`grant_type=authorization_code, client_id, code, code_verifier,
redirect_uri, resource` → **200 in under 1 second** with a valid
Bearer access token.
5. Observe: no further request from Anthropic egress ever reaches the server
(no `initialize`, nothing), and the UI shows "Authorization with the MCP
server failed" with an `ofid_` reference.

Reproduced 4 times across 2 sessions (~01:16 UTC and ~01:38 UTC, 2026-07-21),
identical result each time. References: ofid_26032ef270138c66,
ofid_2d781d262530d32c.

### Area

MCP Connector (adding/managing servers)

### MCP Server (if applicable)

_No response_

### Error messages or logs

```shell

```

### Additional context

_No response_