Under the hood
Useful1 Signal2
MCP OAuth issuer mismatches are now recorded separately from other auth errors.
What's wrong with this entry?
Anonymous. No account, no email.
What
OAuth failures against an MCP server now classify issuer-echo problems separately from generic auth errors, so logs and telemetry can tell them apart from cases like a redirect URI mismatch or a Microsoft Entra specific failure.
Details
- The token refresh path can now fail with the distinct reason
mcp_oauth_refresh_issuer_echo_denied.
Evidence
issuer_echo_mismatch
Strings lifted out of the shipped bundle, so the claim above can be checked against them.