[meta]: Authentication

I've been testing the authentication features with various different clients and will use this issue to document what I've found and for tracking related bugs.

## MCP Inspector

Status: working
Setup:

- Launch the MCP inspector
- Click the Auth tab
- Trigger OAuth flow and MCP inspector gets a token and uses it for tool requests

## Claude Code

Status: working
Setup:

## Codex

Status: not working
Setup:

- Add MCP server to Codex via `codex mcp add --url http://localhost:6200/mcp drupal-mcp`
- Try and authenticate `codex mcp login drupal-mcp`

Issue:

Opens Drupal at:

```
/oauth/authorize?response_type=code&client_id=mcp-client&state=iWXGlsudn0cQZGDDqIB1RA&code_challenge=hczNWzKuzLdcK4SUEJzdUwWTtB0S1H9wIqrsYyhh3Yg&code_challenge_method=S256&redirect_uri=http%3A%2F%2F127.0.0.1%3A60866%2Fcallback
```

Which results in the following error:

```
{"error":"invalid_client","error_description":"Client authentication failed"}
```

## Claude Desktop

Status: not working
Setup:

- Add the MCP to Claude Desktop with something like the following:

```
"mcpServers": {
"drupal-mcp": {
"command": "npx",
"args": [
"-y",
"mcp-remote@latest",
"http://localhost:6200/mcp",
"--transport http-only"
],
"env": {
"NODE_TLS_REJECT_UNAUTHORIZED": "0"
}
}
```

Claude Desktop can connect the MCP server, and use tools that don't require authentication. But any tool that requires authentication will return an error that Claude Desktop doesn't know what to do with. In theory it should trigger the auth flow, but it doesn't.

Example from the Claude Desktop logs:

```
2025-11-05T17:14:31.686Z [drupalizeme-example] [info] Message from client: {"method":"tools/call","params":{"name":"dme_mcp-search_content","arguments":{"keywords":"testing","types":["tutorial"],"page":{"limit":20,"offset":0}}},"jsonrpc":"2.0","id":4} { metadata: undefined }
[3076] [Local→Remote] tools/call
[3076] [Remote→Local] 4
2025-11-05T17:14:31.698Z [drupalizeme-example] [info] Message from server: {"jsonrpc":"2.0","id":4,"error":{"code":-32602,"message":"MCP error -32602: Tool \"dme_mcp-search_content\" requires authentication. Please authenticate first."}} { metadata: undefined }
```

In my testing I can get Claude Desktop to at least try and authenticate if I modify the MCP server code to return an `HTTP 401 - WWW-Authenticate`. Claude will open a Drupal URL, but it won't work because the URL is missing the `scope` parameter and Drupal says the URL is malformed. If you manually add a `&scope=access_member_content` or whatever it'll work, and then Claude is authenticated and can make requests to tools that require authentication. But its far from seamless.

I haven't tested adding the MCP as a "Connector" in Claude which might aleviate some of this as doing that should trigger the authentication flow when you first add the connector. So ... to be tested ...

Start by reproducing the authentication flows through MCP Inspector, Codex, and Claude Desktop, then compare the OAuth requests, the invalid_client response, and the HTTP 401 WWW-Authenticate behavior described here. Done means protected tools authenticate successfully for the supported clients, with any remaining client limitation and its reproducible error documented.

Written by the indexing model from the issue text.