AI & Agent Dev Bug Sandbox logo
AI & Agent Dev Bug SandboxBack to Radar

Claude Code MCP Login Fails With Unrecognized Client_id Due To Version-Keyed OAuth Token Storage And Stale Client Registration

Supabase MCP plugin stores OAuth tokens in a local keychain keyed by a hash of the MCP config that includes the X-Source-Version header. Upgrading from 0.1.12 to 0.1.13 created a second empty credential slot. The new slot contains a client registration that Supabase no longer recognizes, returning HTTP 422 Unrecognized client_id. Claude Code reuses this dead registration instead of re-registering, so login always fails before consent.

highConfidence 85%Claude-Code-McpAffected V0.1.12Affected V0.1.13

Origin Analysis

The OAuth credential is keyed by a hash of the MCP server config, which embeds the plugin version via X-Source-Version. A version bump changes the hash, creating a new keychain slot. The new slot's client registration (client_id a3a97021...) is no longer recognized by Supabase's OAuth endpoint (422 Unrecognized client_id). Claude Code caches this dead registration and never re-registers, so every login attempt fails at the first hop.
1. Install Supabase MCP plugin v0.1.12 and complete OAuth login. 2. Upgrade plugin to v0.1.13. 3. Run /mcp in Claude Code and attempt login. 4. Click the authorize URL; Supabase returns HTTP 422 Unrecognized client_id or the OAuth flow fails before consent.

Fixing Code Block

Edge Case Audit

The access token expires in about 50 minutes and the refresh token was not tested because it could rotate and invalidate the copied credential. The next Supabase plugin release will likely re-create the same split. Rollback: restore the backup file created by the script and restart Claude Code. Do not manually test the refresh token. Older sessions pinned to 0.1.12 may continue using the old slot; after the fix, both slots hold the same credential, but restart old sessions once convenient. A durable fix requires removing X-Source-Version from the keychain hash or stabilizing OAuth client registrations.

Related Intelligence

highnext@16.2.11 bundles vulnerable sharp <0.35.0 (GHSA-f88m-g3jw-g9cj)highPostgREST INSERT fails with 42501 due to missing SELECT privilege when returning representationhighBun runtime on Vercel causes rewritten routes to intermittently serve root pagehighApp Router: chunk <script> tags get no fetchpriority and Chrome's LowPriorityAsyncScriptExecution delays their evaluation — hydration render storm (~30k commits) on cross-site assetPrefix CDNshighBranching create_branch fails MIGRATIONS_FAILED when baseline migration is repair-marked appliedhighpg-meta composite foreign key introspection returns Cartesian product of columns

Ecosystem Topology

Latest critical and high reports

Agent Frameworks

LangChain, LlamaIndex, and Pydantic

LangChainLlamaIndexPydantic
  1. highRecursiveJsonSplitter exceeds max_chunk_size for nested JSON due to missing size checks
  2. highResourceLink converted to URL file block breaks Bedrock Converse and custom MCP URIs
  3. hightool-call continuation deltas can overwrite valid id/name with empty strings
  4. highShellSession incorrectly times out when command output does not end with a newline
  5. highCharacterTextSplitter/RecursiveCharacterTextSplitter corrupt chunk content when merging with non-lookaround regex separator and keep_separator=False

Toolchains

Next.js, Supabase, and the surrounding app stack

Next.jsSupabase
  1. highnext@16.2.11 bundles vulnerable sharp <0.35.0 (GHSA-f88m-g3jw-g9cj)
  2. criticalTurbopack persistent cache poisoning causes worker panic, deadlock, and OOM crash loop
  3. highPostgREST INSERT fails with 42501 due to missing SELECT privilege when returning representation
  4. highBun runtime on Vercel causes rewritten routes to intermittently serve root page
  5. highApp Router: chunk <script> tags get no fetchpriority and Chrome's LowPriorityAsyncScriptExecution delays their evaluation — hydration render storm (~30k commits) on cross-site assetPrefix CDNs