Getting an OAuth-Gated MCP Server Working in a Headless CI Job

Your team wants a nightly claude -p job to file tickets through an MCP server that authenticates via OAuth (no static API token is available for it). The engineer who wrote the job assumed it would "just work" the same way it does in their interactive terminal session, but the first CI run doesn't use the server at all.

1. Explain mechanistically why the CI run can't complete the OAuth flow itself, and what Claude Code does differently - with MCP tool search enabled, which is the default - compared to silently pretending the server isn't configured.
2. Design a fix that lets the nightly job authenticate without a human present at 2am.
3. Your org has since deployed managed-mcp.json on the CI runner to lock down which MCP servers can load at all. Explain how that interacts with the fix from part 2 - could it block it, and what would you check?