Follow Discord
Sweep 30 Oct 2026 · 01:02Z Build v2.1.314 532 read Stable v2.1.308 Latest v2.1.314 Next v2.1.314 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeReleasesv2.1.314entry #52

Claude Code v2.1.314 ·

MCP servers recover when a stored sign-in is rejected

Claude Code stops re-sending a rejected MCP access token, reconnects without it or retries once, and reports failures when clearing saved tokens

Group of 5 You'll notice Improvements
JSON All of v2.1.314
You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
MCPArea: what it touches
ImprovementsKind: in v2.1.314,
ImprovementsSection of the release

What

MCP servers are outside programs that give Claude extra tools, and some need you to sign in with OAuth, a standard way of granting access. Claude Code saves an access token (a stored sign-in) and sometimes a refresh token (used to get a new access token). How it recovers when a server answers 401, meaning "not signed in", has been reworked:

  • Once a server rejects a stored access token, Claude Code stops sending it for the rest of the session and logs "Not sending the stored access token, because the server rejected it earlier in this session".
  • For HTTP and SSE servers, when a stored token is rejected and no refresh token is stored, Claude Code connects again without a token. If that works, it clears the rejected token. The rejection is remembered for the session and in the saved discovery state as tokenlessRejectedAt, so the token is not sent again.
  • A tool call that gets a 401 can now retry once through a reconnect even with no refresh token stored, labelled 'stored sign-in rejected, no refresh token'. Before, a retry needed a stored refresh token.
  • A reconnect that closes the connection in the middle of a call now retries once on the new connection.
  • When an SSE or HTTP connection fails, the failure handling now receives the server's authProvider and runs an extra check before falling back to the 'needs auth' state.
  • MCP tools now carry denyKey and legacyGrantRebindable fields, and a request-id is attached in more cases.
  • Clearing OAuth tokens now reports a failure when the credential store or keychain cannot be read.
  • Base64 blocks in MCP task results are now checked before they are saved.

The tokenless reconnect sits behind the server-side switch tengu_mcp_signed_out_fallback, whose state has not been read.

Why

An out-of-date saved token could leave an MCP server stuck asking you to sign in, or cause repeated 401 errors. Servers that allow access without a token can now connect, more tool calls recover from sign-in failures on their own, and a token-clearing failure is no longer silent.

Read from
Feature flag
tengu_mcp_signed_out_fallback Not enough to say

Nothing here resolved what this flag was doing on this version, so nothing here should be read as on or off.

This account: no value returned · anonymous baseline: no value returned · compiled default in v2.1.314: on

These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.

Read once, for one account on one subscription tier, against v2.1.314. It isn't a statement about your account. What a flag value here can and cannot tell you

How sure we are
One source agreesOne thing we can check says the same as this entry.
The name it cites is new in this buildNew in this build: tengu_mcp_signed_out_fallback

See this entry in the whole of v2.1.314 →

Feedback