MCP element writes return HTTP 406 "needs to reauthorize" on fresh OAuth grants; reads succeed (multiple clients)

[AwakeUS]

Since July 7, 2026 (~11:00 AM PT), all element-level write operations through the Webflow MCP server (mcp.webflow.com/mcp) fail with HTTP 406 and the message "MCP needs to reauthorize. The Webflow MCP connection is no longer authorized," while read operations on the same connection succeed. Element writes on this site worked normally for the preceding weeks.
Affected: data_element_tool write actions (set_settings on an HtmlEmbed's code). Reads via the same tool (query_elements, get_settings) succeed on the same connection, same site, same session.
Site ID: 6a45a9994d98f3a059e8ac0c (page 6a45a99b4d98f3a059e8ac34). User is workspace owner/admin.
Reproduced across: (1) the Claude.ai Webflow connector, and (2) Claude Code with an independently established OAuth grant — identical behavior on both: reads pass, element writes 406.
Already ruled out: full revoke and re-authorization from scratch on both clients (multiple times; the OAuth flow completes and the app re-lists); opening the MCP Bridge App in a live Designer session; different browsers. A REST write via a different surface (page custom code endpoint) also confirms the token itself can write outside the element channel.
Given fresh grants fail identically on two independent clients, this appears server-side — possibly the element-write authorization check regressing, similar in shape to issue #108 (Designer tools failing while Data reads work). Happy to provide timestamps or run diagnostics.

[biancatorchia-reactiv]

Adding a data point that may help narrow this down: we hit the same 406 on
HtmlEmbed code writes, and can confirm the two custom-code write paths are
authorized separately — the same session, same token, held one but not the
other.

Environment

• Claude Code, remote MCP added directly: https://mcp.webflow.com/mcp (HTTP transport)
• Fresh OAuth grant with every read/write scope (incl. "Edit Custom Code data",
  "Edit Page data", "Edit Component data") and all sites authorized
• Site 6a414a2702b4f2eb93cb67c8, workspace owner
• Date: 2026-07-08, both observations within a single continuous session

What worked (same session, same token)

• data_pages_tool — page reads, create_page with duplicateOf
• data_element_tool — element writes: set_text, set_style,
  element creation and removal, incl. creating the HtmlEmbed elements themselves
• data_assets_tool — create_asset direct uploads (MD5 → presigned S3 POST)
• data_scripts_tool — set_page_freeform_code (page head code) succeeded
• Site publish

What failed (same session, same token, ~hours later)

• data_element_tool set_settings with key code on the just-created
  HtmlEmbeds → HTTP 406 "MCP needs to reauthorize" on every attempt

So the Data-API custom-code channel (page-level freeform code) was authorized
and working while the Designer-API custom-code channel (embed code writes) was
rejected — which means "reauthorize" is misleading: the grant was fresh,
complete, and demonstrably valid for the sibling channel. Multiple full
revoke/re-auth cycles on earlier days did not restore embed writes either,
matching the OP.

Possibly related detail from previous weeks on the claude.ai connector: we've
also seen set_site_freeform_code return 406 on every write (including
byte-identical rewrites) while set_page_freeform_code kept working — so
site-level vs page-level freeform code may be split as well.

One more observation we're happy to file as a separate issue if useful: the
claude.ai Webflow connector currently serves a reduced ~20-tool registry
(builder tools only — data_element_builder / data_whtml_builder /
data_component_builder, no data_pages_tool / data_element_tool /
data_assets_tool / data_cms_tool / scripts) on the same full-scope grant,
and the surface has flapped between full and reduced within hours. The direct
mcp.webflow.com/mcp endpoint in Claude Code serves both surfaces side by side.

Happy to provide timestamps or run diagnostics against our site if that helps.