Unclear It is not clear how the v1 MCP client gets selected or whether it is selected by default.
What
When an MCP server (an outside tool connected through the Model Context Protocol) uses OAuth sign-in, Claude Code trades a sign-in code for a token, and later refreshes that token, by contacting the server's token address. With the v1 MCP client selected, Claude Code now allows that address to use plain http instead of encrypted https. This does not apply to XAA sign-ins.
When it happens, Claude Code logs a warning that tokens and client secrets are not encrypted on that connection.
Why
This lets sign-in work with OAuth servers that only offer plain http, but anything sent that way can be read by others on the network.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
It is not clear how the v1 MCP client gets selected or whether it is selected by default.