An MCP server is an outside service that gives Claude extra tools. Some of these servers use OAuth, a sign-in flow in your browser that grants Claude Code a set of permissions called scopes. A new flow handles the case where a tool call to such a server over HTTP is refused because the sign-in lacks a scope the server names. Claude Code can ask "Re-authenticate now?", run the sign-in again asking for the wider scope, and then reconnect to the server. If several refusals from the same server arrive together, they share one prompt.
The prompt is not shown in several cases, including:
- subagents, which are helper agents Claude starts for part of a task
- non-interactive sessions, where nobody is there to answer
- XAA-OAuth servers
The prompt is controlled by the tengu_mcp_step_up_auth_dialog gate, a server-side switch. In readings taken before this release, the flag server returned it off for this site's account and for an anonymous baseline.
Once in use, this would let you fix a missing-permission error by signing in again from the prompt instead of removing and re-adding the server.
tengu_mcp_step_up_auth_dialog Off in both readingsThe flag server returned off for the account this site reads and for the anonymous baseline. A reading of off cannot rule out a rollout these two readings sit outside of.
This account: off · anonymous baseline: off · compiled default in v2.1.281: off
These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.
Read once, for one account on one subscription tier, against v2.1.281. It isn't a statement about your account. What a flag value here can and cannot tell you
New in this build: tengu_mcp_step_up_auth_dialog