You'll notice
MCP OAuth error messages are scrubbed before logging or telemetry so tokens and secrets cannot leak through them.
The MCP OAuth flow now records access tokens, refresh tokens, client secrets, and verifiers into a secret tracker as they're used, and error messages are passed through a scrub function before being logged or sent to telemetry, preventing these secrets from leaking via exception text.