Follow Discord
Sweep 30 Oct 2026 · 01:02Z Build v2.1.314 532 read Stable v2.1.308 Latest v2.1.314 Next v2.1.314 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeReleasesv2.1.314entry #52

Claude Code v2.1.314 ·

MCP servers recover when a stored sign-in is rejected

Claude Code stops re-sending a rejected MCP access token, reconnects without it or retries once, and reports failures when clearing saved tokens

Group of 5 You'll notice Improvements
JSON All of v2.1.314
You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
MCPArea: what it touches
ImprovementsKind: in v2.1.314,
ImprovementsSection of the release

Unclear It is not clear what the extra step does, so it is unknown when it saves you from signing in again.

What

MCP servers are outside programs that give Claude extra tools, and some need you to sign in with OAuth, a standard way of granting access. Claude Code saves an access token (a stored sign-in) and sometimes a refresh token (used to get a new access token). How it recovers when a server answers 401, meaning "not signed in", has been reworked:

  • Once a server rejects a stored access token, Claude Code stops sending it for the rest of the session and logs "Not sending the stored access token, because the server rejected it earlier in this session".
  • For HTTP and SSE servers, when a stored token is rejected and no refresh token is stored, Claude Code connects again without a token. If that works, it clears the rejected token. The rejection is remembered for the session and in the saved discovery state as tokenlessRejectedAt, so the token is not sent again.
  • A tool call that gets a 401 can now retry once through a reconnect even with no refresh token stored, labelled 'stored sign-in rejected, no refresh token'. Before, a retry needed a stored refresh token.
  • A reconnect that closes the connection in the middle of a call now retries once on the new connection.
  • When an SSE or HTTP connection fails, the failure handling now receives the server's authProvider and runs an extra check before falling back to the 'needs auth' state.
  • MCP tools now carry denyKey and legacyGrantRebindable fields, and a request-id is attached in more cases.
  • Clearing OAuth tokens now reports a failure when the credential store or keychain cannot be read.
  • Base64 blocks in MCP task results are now checked before they are saved.

The tokenless reconnect sits behind the server-side switch tengu_mcp_signed_out_fallback, whose state has not been read.

Why

An out-of-date saved token could leave an MCP server stuck asking you to sign in, or cause repeated 401 errors. Servers that allow access without a token can now connect, more tool calls recover from sign-in failures on their own, and a token-clearing failure is no longer silent.

How sure we are
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubtIt is not clear what the extra step does, so it is unknown when it saves you from signing in again.

See this entry in the whole of v2.1.314 →

Feedback