{"version":"2.1.321","anchor":"mcp-oauth-requests-now-refuse-redirects-to-another-origin","canonical_anchor":"mcp-oauth-requests-now-refuse-redirects-to-another-origin","heading":"MCP sign-in requests stop when redirected to a different site","tier":"notice","area":"MCP","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321\/e\/mcp-oauth-requests-now-refuse-redirects-to-another-origin","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321","markdown":"### MCP sign-in requests stop when redirected to a different site\n\nClaude Code now stops an MCP sign-in request that is redirected to another site, or redirected too many times, and tells you why\n\n**Unclear.** The condition that decides when this redirect check runs is not known, so it is unclear whether it is active for everyone by default.\n\n**What**\n\nMCP (Model Context Protocol) servers are outside services that give Claude Code extra tools. Some of them ask you to sign in with OAuth, a standard way of granting access without handing over your password. During that sign-in, Claude Code sends requests that can carry secrets.\n\nClaude Code now checks where those requests are redirected. A redirect is when a server answers \"go to this other address instead\". Claude Code stops the request when:\n\n- it is redirected to a different origin, meaning a different site or port\n\n- it is redirected more times than a set limit\n\nA move from http to https on the same host and default ports still counts as the same site and is allowed. When a request is stopped, the error asks you to tell the owner of the server to remove the redirect. Revoking a sign-in token also uses this check. Token revocation now also sends its authorization details correctly.\n\n**Why**\n\nA redirect could otherwise send sign-in secrets to a site you never meant to talk to. If an MCP server you use starts failing to sign in with this error, the fix is on the server's side, not yours.\n\n- Area: MCP\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: yes"}