{"version":"2.1.299","anchor":"mcp-configured-headers-on-oauth-discoveryrevocation-reser","canonical_anchor":"mcp-configured-headers-on-oauth-discoveryrevocation-reser","heading":"MCP sign-in requests now send your configured headers","tier":"notice","area":"MCP","scope":"both","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.299\/e\/mcp-configured-headers-on-oauth-discoveryrevocation-reser","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.299","markdown":"### MCP sign-in requests now send your configured headers\n\nConfigured MCP headers are now sent when finding OAuth details and revoking tokens, only to the same server\n\n**What**\n\nFor MCP servers (outside programs that give Claude Code extra tools), the extra headers you configure with `headers` or `headersHelper` are now also sent during two steps of OAuth sign-in:\n\n- Looking up the server's sign-in details\n\n- Revoking a sign-in token\n\nBefore, these requests sent no configured headers. The headers are only sent to addresses on the same origin as the server (the same scheme, host and port). A redirect to a different origin is refused with \"Refused a redirect to another origin\". Claude Code can also now refuse to connect with the message \"MCP server refused at a reserved address\".\n\n**Why**\n\nMCP servers that need a header before sign-in can begin now work, while your headers are kept from leaking to other sites.\n\n- Area: MCP\n- Names: `headers`, `headersHelper`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5\n- Scope: both\n- Heads-up: no"}