What
A 401 or 403 from an MCP server whose Authorization header came from a configured headersHelper command is now reported as its own failure, severity "bad", rather than being lumped in with a static auth header rejection. The message tells you OAuth fallback is disabled when the helper supplies Authorization.
Details
- Reported and telemetered as
mcp_connect_headers_helper_auth_rejected, alongside the existing static-header, CLI-bearer and first-party rejection codes. - Message text: "Server rejected the Authorization header minted by the configured headersHelper".
Evidence
mcp_connect_headers_helper_auth_rejected, Server rejected the Authorization header minted by the configured headersHelper
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundleheadersHelper
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on Web search and web fetch touched a line naming headersHelper after this was published.
Set the per-entry `toolPolicy` to `"allow"` so users aren't prompted to approve each search. `headersHelper` is an executable that prints the auth header as a JSON object to stdout; it follows the same execution model as [`inferenceCredent…third-party/claude-desktop/web-tools see the edit
Confirmed since
Anthropic's documentation has since written up headersHelper, on MCP, plugins, skills, and hooks.
| `.mcp.json` | MCP servers bundled with this plugin. A JSON object keyed by server name: `{"mcpServers": {"<name>": {"type": "http", "url": "...", "oauth": true}}}`. A remote entry uses `type` (`http` or `sse`), not `transport`, and suppo…third-party/claude-desktop/extensions see the edit
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up headersHelper, on MCP, plugins, skills, and hooks.
Anthropic's release notes agree
Fixed MCP servers whose headersHelper supplies the Authorization header falling into OAuth discovery on a 401 instead of re-running the…