{"version":"2.1.317","anchor":"mcp-authenticate-gains-redirecturionly-mode-no-localhost-fa","canonical_anchor":"mcp-authenticate-gains-redirecturionly-mode-no-localhost-fa","heading":"MCP sign-in can insist on the host's own redirect address with redirectUriOnly","tier":"use","area":"MCP","scope":"both","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.317\/e\/mcp-authenticate-gains-redirecturionly-mode-no-localhost-fa","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.317","markdown":"### MCP sign-in can insist on the host's own redirect address with redirectUriOnly\n\nmcp_authenticate gains redirectUriOnly, which fails sign-in instead of falling back to a localhost listener when the custom redirect is rejected\n\n**What**\n\n`mcp_authenticate` is the request that apps built on Claude Code, such as SDK hosts and Remote Control, send to sign in to an MCP server (an outside service that gives Claude extra tools). Sign-in uses OAuth, which sends you back to a redirect address once you approve access. That request now accepts a `redirectUriOnly` option.\n\n- The SDK's `mcpAuthenticate` method takes a third argument and forwards its `redirectUriOnly` field. Remote Control's `onMcpAuthenticate` also takes it and passes it on to the sign-in flow.\n\n- When it is set, the supplied `redirectUri` is checked up front, and the check for a pre-registered `clientId` or registration is skipped.\n\n- If the authorization server rejects the custom redirect address, sign-in fails with an 'MCP OAuth failed for' error instead of falling back to a listener on this computer (localhost). Before, it always fell back silently.\n\n- It is refused when the request names no `redirectUri`, or when the server's config sets `oauth.clientId` or `oauth.xaa`, because sign-in might then need a callback on this computer. The message is 'MCP OAuth refused: redirectUriOnly with a configured client'.\n\n- These failures use a new error code, `mcp_redirect_uri_unusable`, in place of `mcp_client_registration_unavailable`.\n\n- Separately, Remote Control's startup now stops early if Remote Control was turned off while it was still starting.\n\n**Why**\n\nHosts that own their redirect address, such as web or remote clients, now get a clear failure instead of a localhost redirect that cannot work for them.\n\n- Area: MCP\n- Names: `redirectUriOnly`\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 2\/5\n- Scope: both\n- Heads-up: no"}