Claude.ai's MCP auth callback requires a state parameter. Generate a random state in /oauth/connect-claude-ai and preserve it through the consent form and login redirect so it is echoed back to claude.ai.