I'm trying to use the first-party Claude Design MCP server from Claude Code, but every connection attempt fails with HTTP 403. I've found no way to fix it and would like to know if anyone has a working solution.

## Setup

- Claude Code: v2.1.252 (CLI, Git Bash)
- OS: Windows 11 Pro
- Account: claude.ai login, Max subscription
- MCP config (user scope):

      claude-design-test: https://api.anthropic.com/v1/design/mcp (HTTP)

## The error

`claude mcp list` shows:

    ✘ Failed to connect — api.anthropic.com rejected your claude.ai login for
    Claude Design (HTTP 403), most likely because a /login token carries no
    Claude Design access. Run /design-login and retry, or check that your
    account has access to Claude Design.

## What I've tried

1. `/design-login`, as the error suggests: "isn't available in this environment".
2. `claude mcp logout claude-design-test` ("Signed out"), then `claude mcp login claude-design-test --no-browser`: it only says it "authenticates automatically with your Claude login. Run `claude login` if you're not signed in." No OAuth flow is started at all.
3. `claude auth status`: loggedIn: true, authMethod: claude.ai, subscriptionType: max.
4. Unauthenticated POST to the endpoint returns 401 "unauthorized", and `/.well-known/oauth-protected-resource/v1/design/mcp` returns 404, so there is no discoverable auth server to log in against.

## What I found

- Other users report that the token scopes from a normal login are `file_upload, inference, mcp_servers, profile, sessions:claude_code`, while the server's `WWW-Authenticate` header demands `user:design:read user:design:write`. The MCP HTTP transport attaches no other credential, so a 403 seems guaranteed.
- The protected-resource metadata points to `https://claude.ai/v1/design/mcp` as the authorization server, but it returns 404 at both RFC 8414 discovery paths (it is only served at `.../.well-known/openid-configuration`).
- The same problem is reported on macOS (versions up to 2.1.278). One user says `/design-login` worked temporarily, but the scopes were dropped after a plain `/login`.

## Questions

1. Is there any supported way to obtain a token with the `user:design:*` scopes so this server connects?
2. Is there a client-side workaround (config, env var, manual token) until the OAuth/discovery flow is fixed?
3. Why does the error message recommend `/design-login` when it isn't available in some builds?

Related GitHub issue: https://github.com/anthropics/claude-code/issues/92215