{"version":"2.1.221","anchor":"mcp-oauth-handles-the-rfc-9207-issuer-parameter","canonical_anchor":"mcp-oauth-handles-the-rfc-9207-issuer-parameter","heading":"MCP OAuth handles the RFC 9207 issuer parameter","tier":"notice","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221\/e\/mcp-oauth-handles-the-rfc-9207-issuer-parameter","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221","markdown":"### MCP OAuth handles the RFC 9207 issuer parameter\n\nMCP OAuth logins now verify the issuer and give clearer errors when client registration is rejected.\n\n**What**\n\nLoopback and manual-URL OAuth callbacks now read `iss` from the query string and carry it into token exchange, and saved MCP tokens record the issuer.\n\n**Details**\n\n- Token exchange receives `authorizationCode: d.code, iss: d.iss`.\n- Saved tokens gain an `issuer` field; an unexpected-issuer check runs when the authorization server advertises iss support.\n- New failure classification `\"dcr_rejected\"` separates a rejected dynamic client registration from the existing `\"dcr_failed\"`.\n- OAuth error matching moved off message and `errorCode` sniffing onto typed SDK errors read via `.code`, covering `invalid_client`, `unauthorized_client` and InvalidGrant.\n\n**Evidence**\n\n`dcr_rejected`\n\n- Area: MCP\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 0\/5"}