{"version":"2.1.265","anchor":"legacy-httpsse-mcp-transport-gets-a-guarded-oauth-avoidance","canonical_anchor":"legacy-httpsse-mcp-transport-gets-a-guarded-oauth-avoidance","heading":"Legacy HTTP+SSE MCP transport gets a guarded OAuth-avoidance dial path","tier":"notice","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.265\/e\/legacy-httpsse-mcp-transport-gets-a-guarded-oauth-avoidance","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.265","markdown":"### Legacy HTTP+SSE MCP transport gets a guarded OAuth-avoidance dial path\n\nOlder MCP servers using the legacy HTTP+SSE protocol no longer get wrongly prompted into an OAuth login flow\n\n**What**\n\nFor MCP servers (external tools Claude Code connects to) that use the older HTTP+SSE connection method rather than newer transports, Claude Code now checks whether a 401 \"unauthorized\" response on the connection request really means the server wants OAuth login. If the server's earlier setup request didn't return a 405 \"method not allowed\" response, the 401 is treated as a genuine OAuth prompt. If it did return 405, Claude Code now refuses to start an OAuth flow at all.\n\n**Why**\n\nThis avoids incorrectly launching an OAuth sign-in flow against MCP servers that don't actually require one, which previously could have interrupted the user with an unnecessary login prompt.\n\n- Area: MCP\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}