MCP sign-in can insist on the host's own redirect address with redirectUriOnly

What

mcp_authenticate is the request that apps built on Claude Code, such as SDK hosts and Remote Control, send to sign in to an MCP server (an outside service that gives Claude extra tools). Sign-in uses OAuth, which sends you back to a redirect address once you approve access. That request now accepts a redirectUriOnly option.

• The SDK's mcpAuthenticate method takes a third argument and forwards its redirectUriOnly field. Remote Control's onMcpAuthenticate also takes it and passes it on to the sign-in flow.
• When it is set, the supplied redirectUri is checked up front, and the check for a pre-registered clientId or registration is skipped.
• If the authorization server rejects the custom redirect address, sign-in fails with an 'MCP OAuth failed for' error instead of falling back to a listener on this computer (localhost). Before, it always fell back silently.
• It is refused when the request names no redirectUri, or when the server's config sets oauth.clientId or oauth.xaa, because sign-in might then need a callback on this computer. The message is 'MCP OAuth refused: redirectUriOnly with a configured client'.
• These failures use a new error code, mcp_redirect_uri_unusable, in place of mcp_client_registration_unavailable.
• Separately, Remote Control's startup now stops early if Remote Control was turned off while it was still starting.

Why

Hosts that own their redirect address, such as web or remote clients, now get a clear failure instead of a localhost redirect that cannot work for them.