When connecting to an MCP server over OAuth, Claude now compares the authorization-server address it asked about against the issuer value the server returns in its discovery metadata, catching a server that points authentication somewhere else. In this build the check only records telemetry: the gate tengu_mcp_issuer_strict_echo decides the mode and its in-source fallback is false, so absent a remote value the result is observe-only.
- In
observemode a mismatch is logged with outcomeproceededand the connection continues. - In
enforcemode the connection raises an issuer echo cross-origin error and authentication fails with reasonissuer_echo_denied. - Mismatches are classified before reporting, including
same_originandunparseableplus a reason per differing part of the URL. - None of this exists in 2.1.223; the whole check is new.
tengu_mcp_oauth_issuer_echo_mismatch
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
tengu_mcp_issuer_strict_echo Not enough to sayNothing here resolved what this flag was doing on this version, so nothing here should be read as on or off.
This account: no value returned · anonymous baseline: no value returned · compiled default in v2.1.224: off
These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.
Read once, for one account on one subscription tier, against v2.1.224. It isn't a statement about your account. What a flag value here can and cannot tell you
New in this build: tengu_mcp_issuer_strict_echo