Unclear The condition that decides when this redirect check runs is not known, so it is unclear whether it is active for everyone by default.
MCP (Model Context Protocol) servers are outside services that give Claude Code extra tools. Some of them ask you to sign in with OAuth, a standard way of granting access without handing over your password. During that sign-in, Claude Code sends requests that can carry secrets.
Claude Code now checks where those requests are redirected. A redirect is when a server answers "go to this other address instead". Claude Code stops the request when:
- it is redirected to a different origin, meaning a different site or port
- it is redirected more times than a set limit
A move from http to https on the same host and default ports still counts as the same site and is allowed. When a request is stopped, the error asks you to tell the owner of the server to remove the redirect. Revoking a sign-in token also uses this check. Token revocation now also sends its authorization details correctly.
A redirect could otherwise send sign-in secrets to a site you never meant to talk to. If an MCP server you use starts failing to sign in with this error, the fix is on the server's side, not yours.
The condition that decides when this redirect check runs is not known, so it is unclear whether it is active for everyone by default.