{"version":"2.1.274","anchor":"mcp-auth-error-classification-reworked-to-add-a-403-step-up","canonical_anchor":"mcp-tool-call-reauth-new-step-up-scope-handling-for-insuffi","heading":"MCP tools now support 'step-up' re-authentication for insufficient permissions","tier":"notice","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.274\/e\/mcp-auth-error-classification-reworked-to-add-a-403-step-up","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.274","markdown":"### MCP tools now support 'step-up' re-authentication for insufficient permissions\n\nMCP tool calls that fail from insufficient permissions now prompt you to re-authenticate for the missing scope, instead of a generic credential error\n\n**What**\n\n- MCP auth failures are now classified into two distinct kinds: `credential_rejected` (a flat, generic rejection) and a new `step_up`, which covers a 403 \"insufficient_scope\" response. This classification is handled by a new shared function\/classifier instead of duplicated inline checks.\n\n- When an MCP tool call gets a 403 insufficient-scope error, Claude Code now surfaces a specific message asking you to re-authenticate for the additional permissions needed, rather than treating it like a generic expired or rejected credential.\n\n- Whether a step-up is pending is tracked per MCP client connection (via `pendingStepUpScope`), and this pending state is now properly cleared: when a fresh 401 (not 403) response is seen, when the underlying credential itself disappears (for example, \"no token data found\" or \"token expired without refresh token\"), and it's now only checked\/set when the original request actually carried an Authorization header.\n\n- The auth-challenge interceptor now also ignores responses to requests that had no Authorization header at all, and parses the `WWW-Authenticate` header's scope through a shared helper instead of inline regular expressions.\n\n**Why** Previously, an MCP server asking for additional OAuth permissions looked the same as a fully rejected or expired credential, so Claude Code could only tell you to \"re-authenticate\" without saying why. Now it can tell you specifically that more permissions (scope) are needed, and correctly resets that state once you've re-authenticated or the credential changes.\n\n- Area: MCP\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}