You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
MCPArea: what it touches
ImprovementsKind: in v2.1.224,
ImprovementsSection of the release
What
Cached OAuth discovery details for MCP servers are now re-checked against policy before reuse and kept only for a fixed window. If the cached authorization server fails the check, stored credentials are invalidated and the cached entry is cleared instead of being reused, so a server that has moved or been disallowed no longer silently authenticates against a stale endpoint.
Evidence
Returning cached discovery state (authServer:
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
