{"version":"2.1.231","anchor":"mcp-oauth-callback-now-redirects-to-localhost-rather-than-12","canonical_anchor":"mcp-oauth-callback-now-redirects-to-localhost-rather-than-12","heading":"MCP OAuth callback now redirects to localhost rather than 127.0.0.1","tier":"notice","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.231\/e\/mcp-oauth-callback-now-redirects-to-localhost-rather-than-12","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.231","markdown":"### MCP OAuth callback now redirects to localhost rather than 127.0.0.1\n\nMCP OAuth logins now send you back via localhost, so servers only allowing the IP form will reject you.\n\n**What**\n\nWhen Claude Code logs in to an MCP server over OAuth, the default address it hands the server to send you back to is now `http:\/\/localhost:<port>\/callback` instead of `http:\/\/127.0.0.1:<port>\/callback`. If a server has the old IP form registered as its only allowed redirect, that login will now be rejected until the localhost form is added.\n\n**Details**\n\n- The port is taken from the server's `oauth.callbackPort` setting, falling back to Claude Code's own MCP OAuth callback port.\n- Configuring an explicit `redirectUri` for a server still overrides this entirely, and that path logs \"(no localhost listener)\" since Claude Code is not the one receiving the redirect.\n- This aligns the default with two other places in the same code that already built the localhost form, so all three now agree.\n\n**Evidence**\n\n`\/callback`\n\n- Area: MCP\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}