GitHub issue #52871 in anthropics/claude-code, opened 2026-04-24 by danielvos1998, records a report that the Claude Code MCP OAuth client appends a trailing slash to the resource parameter on both the authorize redirect and the token exchange, so that when the metadata of an MCP server declares the resource URI without a trailing slash, Microsoft Entra ID rejects the request with AADSTS9010010.
Verbatim Excerpts from Cited Records
“Claude Code's MCP OAuth client appends a trailing `/` to the `resource` parameter on both the `/authorize` redirect and the `/token` exchange.”
·
anthropics/claude-code (issue 52871 opening body, What is Wrong section)
·
2026-04-24T13:45:51Z
·GitHub Issue ↗
“When the MCP server's `.well-known/oauth-protected-resource` metadata declares the resource URI **without** a trailing slash, the `resource` parameter no longer matches the implicit resource of the requested `scope`.”
·
anthropics/claude-code (issue 52871 opening body, What is Wrong section)
·
2026-04-24T13:45:51Z
·GitHub Issue ↗
“Microsoft Entra ID rejects the request with `AADSTS9010010: The resource parameter provided in the request doesn't match with the requested scopes.`”
·
anthropics/claude-code (issue 52871 opening body, What is Wrong section)
·
2026-04-24T13:45:51Z
·GitHub Issue ↗
Counter-record: Issue remains open as of 2026-10-28 with 51 comments. Surveyed comments show many independent confirmations across Entra-protected MCP servers (Business Central, Azure DevOps, Fabric, Bedrock AgentCore gateway) and workarounds (path-qualified identifier URI, standalone PKCE flow, OAuth proxy). The latest surveyed comment (2026-10-28, sean-regents) notes the upstream SDK fix (modelcontextprotocol/typescript-sdk #2581, merged 2026-09-03) but says it had not reached Claude Code in any report as of then; later comments also raise related but distinct cells (Auth0 as authorization server, two resources on one origin) that a trailing-slash only fix would not resolve. The claim documents the original report, not any later fixed state.
Falsification probe: If issue #52871 is deleted without archive, if the author edits the opening body so the quoted sentences no longer match verbatim, or if the author or maintainers post a definitive retraction showing the described behavior was mischaracterized, this claim drops to Withdrawn.
Audit verification: Verified 100% continuous verbatim substring against official GitHub REST API by
scripts/verify_claim_verbatim.py.