mcp-oauth has no filter for this, so AuthorizeGate runs on template_redirect before its router and stops the browser endpoints (authorize, authorize-callback, consent) for logged-in users without lit_mcp_use with "Dein Benutzer hat keinen Zugriff auf LIT MCP." (403). Login redirect, token and revoke stay mcp-oauth's. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7