The plugin hooks fetch event now supports an auth option resolved via $.session.authorize(), which mints an opaque handle. When the fetch's target host matches the authorized handle's host, the handle's headers are merged into the outgoing request; they're dropped again if a redirect crosses to a different host.
Names in the bundleauth
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on Monitoring touched a line naming auth after this was published.
* When authenticated via OAuth, `user.email` is included in telemetry attributes, sent only to the OTel endpoint you configure, never to Anthropic. If this is a concern for your organization, work with your telemetry backend to filter or r…monitoring-usage see the edit
Confirmed since
Anthropic's documentation has since written up auth, on MCP, plugins, skills, and hooks.
| `.mcp.json` | MCP servers bundled with this plugin. A JSON object keyed by server name: `{"mcpServers": {"<name>": {"type": "http", "url": "...", "oauth": true}}}`. A remote entry uses `type` (`http` or `sse`), not `transport`, and suppo…third-party/claude-desktop/extensions see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up auth, on MCP, plugins, skills, and hooks.