tengu_mcp_step_up_auth_dialog
A Claude Code feature flag, read out of the shipped bundle. It has been in the build since v2.1.281, including the newest one read.
Claude Code can offer to sign in to an MCP server again with wider permissions when a tool call is refused for missing scope
Not Anthropic's. This is the line from the earliest changelog entry here that named it, v2.1.281.
In the changelogs
6Releases whose published page names tengu_mcp_step_up_auth_dialog.
-
v2.1.288
Dialogs where an MCP server asks you for input can ask you to confirm you are done
The dialog an MCP server uses to ask you for input can now be told you will confirm when you are done, and can check whether an answer would be taken
gate cited by this entry
-
v2.1.288
MCP sign-in now notices when a server asks for more permission
Claude Code now checks each MCP server sign-in response for a missing-permission answer and returns the server's real response
gate cited by this entry
-
v2.1.288
Remote sessions gain steps for repository agents, skills and switching
Remote sessions have new named setup steps for repository agents, skills, root registration, switches and flag prefetching
gate cited by this entry
-
v2.1.288
MCP step-up sign-in dialog now defaults to on
The dialog for MCP servers that ask you to sign in again with extra permissions now falls back to on when the server sends no setting
gate cited by this entry
-
v2.1.281
MCP step-up re-authentication prompt for 403 insufficient_scope (dark-launched)
Claude Code can offer to sign in to an MCP server again with wider permissions when a tool call is refused for missing scope
gate cited by this entry, found in this entry's text
-
v2.1.281
MCP tool calls can ask for consent and re-authenticate when a server returns 403 insufficient_scope (gated off)
MCP tool calls refused for missing permissions can prompt you to sign in again and retry, behind a gate
gate cited by this entry, found in this entry's text
Gate readings
2| Release | Resolved | This account | Anonymous | Compiled default |
|---|---|---|---|---|
| v2.1.288 read on another version | On for this account, and not off by default | on | on | on |
| v2.1.281 read on another version | Off in both readings | off | off | off |
Two arms, because they disagree: this account is the one account this site reads and anonymous is a baseline with no identity attached. A reading says nothing about your account, and off cannot rule out a rollout both readings sit outside of. What these readings can and cannot show.
Flag server, over time
16| Read as | Reading | From | Until | Version installed |
|---|---|---|---|---|
| this account | on | 2026-11-02T13:05:04Z | 2026-11-12T17:25:05Z | v2.1.316 to v2.1.322 |
| anonymous | on | 2026-10-17T05:30:04Z | 2026-11-12T17:25:05Z | v2.1.302 to v2.1.322 |
| this account | off | 2026-11-02T12:55:05Z | 2026-11-02T12:55:05Z | v2.1.316 |
| this account | on | 2026-11-01T20:45:05Z | 2026-11-02T12:40:07Z | v2.1.316 |
| this account | off | 2026-11-01T20:40:05Z | 2026-11-01T20:40:05Z | v2.1.316 |
| this account | on | 2026-11-01T20:25:04Z | 2026-11-01T20:30:06Z | v2.1.316 |
| this account | off | 2026-11-01T20:20:05Z | 2026-11-01T20:20:05Z | v2.1.316 |
| this account | on | 2026-10-07T18:00:12Z | 2026-11-01T19:30:06Z | v2.1.292 to v2.1.316 |
| anonymous | no longer carried | 2026-10-17T05:25:57Z | 2026-10-17T05:25:57Z | v2.1.302 |
| anonymous | on | 2026-09-30T08:30:06Z | 2026-10-17T05:10:04Z | v2.1.285 to v2.1.302 |
| this account | off | 2026-10-07T17:59:34Z | 2026-10-07T17:59:34Z | v2.1.293 |
| this account | on | 2026-09-29T18:05:06Z | 2026-10-07T17:10:05Z | v2.1.284 to v2.1.292 |
| anonymous | off | 2026-09-21T14:15:05Z | 2026-09-30T07:35:04Z | v2.1.278 to v2.1.285 |
| this account | off | 2026-09-29T18:02:52Z | 2026-09-29T18:02:52Z | v2.1.285 |
| this account | on | 2026-09-29T10:00:07Z | 2026-09-29T17:40:06Z | v2.1.284 |
| this account | off | 2026-09-21T15:25:05Z | 2026-09-29T08:25:05Z | v2.1.278 to v2.1.284 |
One row per unbroken stretch of one reading, newest first, from snapshots taken every twenty-five minutes or so. No longer carried is not off: it means the flag server stopped returning the gate at all, which is what a retired experiment looks like. The version column is what was installed when the reading was taken, not what caused it.
First cited
1The earliest release whose published evidence quoted tengu_mcp_step_up_auth_dialog was v2.1.281, 23 Sep 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
Presence across releases
1Build by build
38One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the feature flag does. All feature flags.