What
MCP servers are outside programs that give Claude Code extra tools. A plugin's MCP server can be reached through a small local web server on your own machine, protected by a secret.
- The plugin's MCP config no longer puts the secret in the address. The address is now just the port, plugin name and version, and the secret is sent as
Authorization: Bearer <secret>. - The local handler now reads the secret from the
authorizationheader asBearer ${n.secret}, compares it with a constant-length check, and answers "not found" if it does not match. Before, it took the secret from the first part of the URL path.
Why
Addresses often end up in logs and error messages, so keeping the secret out of the URL keeps it out of those places too.