{"version":"2.1.257","anchor":"mcp-oauthjwt-bearer-secrets-now-registered-with-a-redaction","canonical_anchor":"mcp-oauthjwt-bearer-secrets-now-registered-with-a-redaction","heading":"New ku().record() redaction registry used across MCP auth code paths","tier":"internal","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257\/e\/mcp-oauthjwt-bearer-secrets-now-registered-with-a-redaction","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257","markdown":"### New ku().record() redaction registry used across MCP auth code paths\n\nMCP auth secrets are registered with a scrubbing utility so they can be redacted from logs and quoted response bodies.\n\nSeveral MCP authentication code paths now call `ku().record(...)` to register sensitive values before they are used or attached to requests: the claude.ai proxy bearer token, the XAA jwt-bearer client secret\/assertion, a basic-auth header, and WS auth tokens. Bearer tokens sent to claude.ai-backed servers are likewise recorded via `ku().record(...)` before being attached to the Authorization header, in both the claude.ai-proxy and generic OAuth request wrappers.\n\nWhen constructing SSE\/HTTP\/WS MCP transports, custom headers are also passed through a new `$le(headers, ...)` call before the transport is built. `$le` scans header names\/values against a secret-pattern regex (`auth|token|key|secret|cookie|session|sig|pass|cred|bearer`) and records matches via `ku().record(...)` unless `recordingOff()`, tracking credential-like strings seen in outgoing MCP requests, presumably for later redaction or leak detection.\n\n- Area: MCP\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 3\/5"}