Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.221 Home All releases ←olderv2.1.220 v2.1.222newer→
Claude Code v2.1.221

MCP OAuth tracks the issuer through the callback and token exchange

Under the hood
Useful3 Signal0
MCP

MCP OAuth now tracks which authorization server issued your token through login, refresh, and storage.

What

The OAuth flow now carries the authorization server issuer from the callback into the token exchange and into stored credentials.

Details
  • both the local callback listener and the manual callback-URL path read the iss query parameter and pass it into the token exchange
  • the local callback server resolves { code, iss } instead of just a code
  • stored and served client information and the token response carry an issuer field, and the token provider returns { ...a, issuer: n?.issuer } on both the refresh and the silent-exchange paths
  • _flowDiscoveryState caches the discovered authorization-server metadata on the provider instance
  • revoke calls a cleanup helper before reporting mcp_oauth_revoke
  • new device-code error sets were added, including authorization_pending
Evidence

authorization_pending, _flowDiscoveryState

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.221 →