What
If an MCP server's headersHelper command mints an Authorization header, Claude Code no longer layers an OAuth flow or first-party auto-auth on top of it, matching what it already did for a statically configured Authorization header.
Details
- Resolved headers are now computed once up-front for
sse,httpandwsservers, before any transport is built, and checked for an Authorization key. - Driven entirely by the
headersHelperconfig key, which the sse, http and ws server schemas accept. No feature flag.
Evidence
headersHelper
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundleheadersHelper
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on Web search and web fetch touched a line naming headersHelper after this was published.
Set the per-entry `toolPolicy` to `"allow"` so users aren't prompted to approve each search. `headersHelper` is an executable that prints the auth header as a JSON object to stdout; it follows the same execution model as [`inferenceCredent…third-party/claude-desktop/web-tools see the edit
Confirmed since
Anthropic's documentation has since written up headersHelper, on MCP, plugins, skills, and hooks.
| `.mcp.json` | MCP servers bundled with this plugin. A JSON object keyed by server name: `{"mcpServers": {"<name>": {"type": "http", "url": "...", "oauth": true}}}`. A remote entry uses `type` (`http` or `sse`), not `transport`, and suppo…third-party/claude-desktop/extensions see the edit
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up headersHelper, on MCP, plugins, skills, and hooks.
Anthropic's release notes agree
Fixed MCP servers whose headersHelper supplies the Authorization header falling into OAuth discovery on a 401 instead of re-running the…