{"version":"2.1.314","anchor":"mcp-signed-out-fallback-retry-without-a-rejected-stored-tok","canonical_anchor":"mcp-oauth-failure-path-gets-an-authprovider-based-pre-check","heading":"MCP servers recover when a stored sign-in is rejected","tier":"notice","area":"MCP","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.314\/e\/mcp-signed-out-fallback-retry-without-a-rejected-stored-tok","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.314","markdown":"### MCP servers recover when a stored sign-in is rejected\n\nClaude Code stops re-sending a rejected MCP access token, reconnects without it or retries once, and reports failures when clearing saved tokens\n\n**What**\n\nMCP servers are outside programs that give Claude extra tools, and some need you to sign in with OAuth, a standard way of granting access. Claude Code saves an access token (a stored sign-in) and sometimes a refresh token (used to get a new access token). How it recovers when a server answers 401, meaning \"not signed in\", has been reworked:\n\n- Once a server rejects a stored access token, Claude Code stops sending it for the rest of the session and logs \"Not sending the stored access token, because the server rejected it earlier in this session\".\n\n- For HTTP and SSE servers, when a stored token is rejected and no refresh token is stored, Claude Code connects again without a token. If that works, it clears the rejected token. The rejection is remembered for the session and in the saved discovery state as `tokenlessRejectedAt`, so the token is not sent again.\n\n- A tool call that gets a 401 can now retry once through a reconnect even with no refresh token stored, labelled 'stored sign-in rejected, no refresh token'. Before, a retry needed a stored refresh token.\n\n- A reconnect that closes the connection in the middle of a call now retries once on the new connection.\n\n- When an SSE or HTTP connection fails, the failure handling now receives the server's `authProvider` and runs an extra check before falling back to the 'needs auth' state.\n\n- MCP tools now carry `denyKey` and `legacyGrantRebindable` fields, and a request-id is attached in more cases.\n\n- Clearing OAuth tokens now reports a failure when the credential store or keychain cannot be read.\n\n- Base64 blocks in MCP task results are now checked before they are saved.\n\nThe tokenless reconnect sits behind the server-side switch `tengu_mcp_signed_out_fallback`, whose state has not been read.\n\n**Why**\n\nAn out-of-date saved token could leave an MCP server stuck asking you to sign in, or cause repeated 401 errors. Servers that allow access without a token can now connect, more tool calls recover from sign-in failures on their own, and a token-clearing failure is no longer silent.\n\n- Flag `tengu_mcp_signed_out_fallback`: Not enough to say (read for one account on one subscription tier against v2.1.314; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: MCP\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: no"}