What
When an MCP server's OAuth tokens are replaced (e.g., during re-authentication or token refresh), the old access and refresh tokens are now explicitly revoked at the server's revocation_endpoint before they are discarded.
Details
- Discovers the revocation endpoint from OAuth server metadata
- Supports both
client_secret_basicandclient_secret_postauthentication methods - Revokes refresh token first, then access token
- Logs failures with
Failed to revoke refresh token:/Failed to revoke access token:but does not block the replacement
Evidence
Token revocation (search for "Failed to revoke replaced tokens:" or "No replaced tokens to revoke").
Strings lifted out of the shipped bundle, so the claim above can be checked against them.