{"version":"2.1.224","anchor":"mcp-oauth-failures-name-the-specific-issuer-mismatch","canonical_anchor":"mcp-oauth-failures-name-the-specific-issuer-mismatch","heading":"MCP OAuth failures name the specific issuer mismatch","tier":"notice","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224\/e\/mcp-oauth-failures-name-the-specific-issuer-mismatch","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224","markdown":"### MCP OAuth failures name the specific issuer mismatch\n\nMCP OAuth failures now tell you it was an issuer mismatch instead of a generic error.\n\n**What**\n\nWhen an MCP server's OAuth flow fails because the server echoed back the wrong issuer, the failure is now reported with a specific reason rather than a generic one, making misconfigured servers easier to identify.\n\n**Details**\n\n- Three new failure reasons: `issuer_echo_denied`, `issuer_echo_mismatch` and `issuer_response_mismatch`, each raised from its own error class and checked ahead of the existing reasons.\n- One authorization-server metadata discovery path now skips the library's built-in issuer check and validates the issuer itself afterwards, throwing the existing \"AS metadata discovery failed: issuer mismatch\" error.\n- MCP connect telemetry gains a sibling-probe field, computed only in `auto` negotiation mode, on both the success event and `tengu_mcp_server_connection_failed`.\n\n**Evidence**\n\n`issuer_echo_denied`\n\n- Area: MCP\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 1\/5"}