MCP servers are outside programs that give Claude Code extra tools, and some require you to sign in through OAuth, a standard login and permission system. When Claude Code sends one of these signed-in requests, it now checks every answer the server sends back. Two answers are marked as meaning the current sign-in is not enough:
- a 401 response, which means not authorised
- a 403 response that reports
insufficient_scope, which means the sign-in lacks a permission the server needs
This part of the code also had a fault: it returned an out-of-date value instead of the server's real response. It now returns the actual response.
These answers are what a "step-up" sign-in would act on. Step-up means asking you to grant more permission when a server says your current login does not cover the request. A server-side switch for a step-up sign-in dialog read as on for this site's account and for an anonymous check, first seen on 2026-09-29.
tengu_mcp_step_up_auth_dialog On for this account, and not off by defaultThe flag server returned on for the one account this site reads, and nothing in this release compiles it off by default. The compiled default is shown below, and says which it is when we cannot read one: a fifth of gates compile in a string or a number rather than on or off, and most published releases have no gate table behind them at all. No client can see what the server returns for your account.
This account: on · anonymous baseline: on · compiled default in v2.1.288: on
These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.
Read once, for one account on one subscription tier, against v2.1.288. It isn't a statement about your account. What a flag value here can and cannot tell you
It is not shown where the step-up dialog switch is read, so the link between this change and that dialog is unconfirmed.