{"version":"2.1.281","anchor":"mcp-tool-calls-can-ask-for-consent-and-re-authenticate-when","canonical_anchor":"mcp-tool-calls-can-ask-for-consent-and-re-authenticate-when","heading":"MCP tool calls can ask for consent and re-authenticate when a server returns 403 insufficient_scope (gated off)","tier":"soon","area":"MCP","url":"https:\/\/changelogs.core-directive.com\/v\/2.1.281\/e\/mcp-tool-calls-can-ask-for-consent-and-re-authenticate-when","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.281","markdown":"### MCP tool calls can ask for consent and re-authenticate when a server returns 403 insufficient_scope (gated off)\n\nMCP tool calls refused for missing permissions can prompt you to sign in again and retry, behind a gate\n\n**What**\n\nMCP servers (Model Context Protocol servers, which give Claude extra tools) can refuse a tool call with an HTTP 403 error saying the login lacks a permission. The extra permission is named as a `requestedScope`. Claude Code can now respond by asking you:\n\n\"needs additional permissions for this tool ... Re-authenticate now?\"\n\nIf you agree, it runs the OAuth sign-in again (the login flow many MCP servers use), reconnects to the server and retries the tool once. It only asks in these cases:\n\n- HTTP MCP servers only\n\n- Not servers using XAA\n\n- Not calls made by a subagent (a helper Claude starts to handle part of a task)\n\n- Not non-interactive sessions\n\n- Not servers on a denylist\n\nIf several calls to the same server hit this at once, only one sign-in runs. Outcomes are reported under `mcp_step_up_reauth`. All of this sits behind the `tengu_mcp_step_up_auth_dialog` gate.\n\n**Why**\n\nA tool that needs more access than you first granted can be fixed with one sign-in, so the call does not simply fail. The flag server returned `tengu_mcp_step_up_auth_dialog` off for this site's own account and for an anonymous baseline. No reading has been taken under this release yet.\n\n- Flag `tengu_mcp_step_up_auth_dialog`: Off in both readings (read for one account on one subscription tier against v2.1.281; this account: off, anonymous baseline: off, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: MCP\n- Tier: Nothing to try yet\n- Useful: 5\/5\n- Signal: 5\/5\n- Present in the build but not switched on"}