Reference claude ai mcp cli session auth

Behavior confirmed 2026-05-17 via spawned worker test:

The claude.ai Gmail, Calendar, and Drive MCP connectors authenticate fine in claude.ai web (sticky auth). In Claude Code CLI sessions, however, each session boots the claudeai-proxy server in unauthenticated mode. Auth completed in one session does NOT carry over to any other session (parent, child, or sibling).

Only the bootstrap pair is exposed until auth completes within that session: - mcp__claude_ai_Gmail__authenticate - mcp__claude_ai_Gmail__complete_authentication

Real data tools (search_messages, list_events, etc.) only materialize after running the OAuth flow inside the same session.

To use Gmail/Calendar in an interactive CLI session: call mcp__claude_ai_Gmail__authenticate, open the returned URL, paste the callback URL back via complete_authentication. After that, real tools appear via ToolSearch.

Headless workers (/spawn) cannot use these connectors — they can't click an OAuth button.

Forge backend path: Anthropic Messages API supports remote MCP servers via anthropic-beta: mcp-client-2025-11-20 header with authorization_token in the mcp_servers payload. Requires an Anthropic API account (API spend, not subscription quota), plus a one-time OAuth flow via MCP Inspector to obtain a refreshable token stored in ~/.forge-secrets/.

[auto-memory session 1a660aac-56d2-400d-8206-c59564bbff19, confidence 0.88, mode direct]