{"version":"2.1.248","anchor":"separate-failure-code-when-a-credential-helper-s-token-is-re","canonical_anchor":"separate-failure-code-when-a-credential-helper-s-token-is-re","heading":"Separate failure code when a credential helper's token is rejected","tier":"notice","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248\/e\/separate-failure-code-when-a-credential-helper-s-token-is-re","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248","markdown":"### Separate failure code when a credential helper's token is rejected\n\nA rejected credential-helper token is now reported as its own MCP failure with clearer advice.\n\n**What**\n\nA 401 or 403 from an MCP server whose Authorization header came from a configured `headersHelper` command is now reported as its own failure, severity \"bad\", rather than being lumped in with a static auth header rejection. The message tells you OAuth fallback is disabled when the helper supplies Authorization.\n\n**Details**\n\n- Reported and telemetered as `mcp_connect_headers_helper_auth_rejected`, alongside the existing static-header, CLI-bearer and first-party rejection codes.\n- Message text: \"Server rejected the Authorization header minted by the configured headersHelper\".\n\n**Evidence**\n\n`mcp_connect_headers_helper_auth_rejected`, `Server rejected the Authorization header minted by the configured headersHelper`\n\n- Area: MCP\n- Names: `headersHelper`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}