Claude Design first-party MCP always 403s: transport never attaches design-scoped token, `claude mcp login` OAuth flow is dead, and the error message suggests a nonexistent `/design-login` command

**Environment:**
- Claude Code v2.1.261 (latest at time of filing), macOS (Darwin 24.6.0)
- claude.ai Max account with confirmed Claude Design access (web UI works; the MCP itself worked from this machine in early July 2026)
- Server config (user scope): `"claude-design": {"type": "http", "url": "https://api.anthropic.com/v1/design/mcp"}`

**Symptom:**
Connection fails every session with:
> FIRST_PARTY_AUTH_REJECTED: api.anthropic.com rejected your claude.ai login for Claude Design (HTTP 403) ... Run /design-login and retry

**What I verified:**
1. `/design-login` — the command the error message recommends — does not exist ("command not found"). Phantom command.
2. My `claudeAiOauth` token scopes are `[file_upload, inference, mcp_servers, profile, sessions:claude_code]`. The server's live `WWW-Authenticate` header demands `scope="user:design:read user:design:write"`. The standard `/login` flow never requests design scopes, and the MCP HTTP transport never attaches any other credential → 403 is guaranteed. (Same root cause as closed issue #69317.)
3. `claude mcp login claude-design` cannot mint the missing token: the flow hits a decommissioned /authorize endpoint (HTTP 410) and hangs. (Same as closed issue #77620.) The resource metadata at `https://api.anthropic.com/v1/design/.well-known/oauth-protected-resource` advertises `https://claude.ai/v1/design/mcp` as the authorization server, but that server publishes no valid `oauth-authorization-server` metadata (404), so RFC 9728 discovery dead-ends too.
4. Ruled out local causes: single config scope, no duplicate/shadowed entries, endpoint alive (405/401 on unauthenticated probes), latest CLI, entitled account.

**Ask:**
Both prior issues (#69317, #77620) were closed without a fix, but the failure is fully reproducible and self-consistent: no token with design scopes can be obtained, and no design-scoped token would be attached if it existed. Please either (a) fix the OAuth flow + token attachment for the claude-design first-party server, or (b) remove the server type and the `/design-login` suggestion from the error copy so users stop chasing a nonexistent command.

Start by reproducing the 403 against the configured Claude Design MCP endpoint and trace the standard /login, `claude mcp login claude-design`, and MCP HTTP transport paths described in the report. Verify how design scopes are obtained and attached, then check the error copy suggesting `/design-login`; done means the authenticated flow works or the unsupported server type and suggestion are removed, with coverage for the reported failure.

Scritto dal modello di indicizzazione a partire dal testo della issue.