{"version":"2.1.257","anchor":"mcp-oauth-logs-now-redact-scope-urls-and-tokens","canonical_anchor":"mcp-oauth-logs-now-redact-scope-urls-and-tokens","heading":"MCP OAuth\/XAA logging now redacts URLs and scopes, and tracks presented tokens","tier":"notice","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257\/e\/mcp-oauth-logs-now-redact-scope-urls-and-tokens","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257","markdown":"### MCP OAuth\/XAA logging now redacts URLs and scopes, and tracks presented tokens\n\nMCP OAuth debug logs now redact scopes, URLs and tokens, with handed-out secrets tracked so they can be scrubbed.\n\nMCP\/XAA discovery and connection error messages that previously interpolated raw URLs (issuer, token endpoint, resource) now pass them through a `zn(...)` helper before inclusion in error text, and the MCP OAuth client's debug logging also runs scope values through a `rw(\"scope\", ...)` redaction helper, covering messages like 'Using scope from metadata:' and 'Overrode authorization scope from...'.\n\nA new `_presented` tracker records access tokens, refresh tokens, client secrets, and code verifiers whenever they are handed out (e.g. `this._presented.record(e?.client_secret)`, `this._presented.record(k.access_token)`), in addition to the existing `_lastServedAccessToken`\/`_lastServedRefreshToken` tracking, apparently to support redaction or duplicate\/leak detection for tokens.\n\n- Area: MCP\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}