Under the hood
MCP OAuth error messages are now run through a redaction helper before being logged or sent
What
When Claude Code's MCP (Model Context Protocol, the system that lets Claude talk to external tool servers) authentication flow fails, the error text it produces is now built through a new redaction helper before it is logged or sent back over the control channel. This applies to errors from the authentication step, the OAuth callback URL handling, and the redirect-URI fallback logging.
Why
This reduces the chance that sensitive details (such as tokens or internal URLs) leak into logs or error messages shown to the user when an MCP server's authentication fails.