{"version":"2.1.323","anchor":"mcp-oauth-http-token-endpoint-allowed-under-v1-mcp-client","canonical_anchor":"mcp-oauth-http-token-endpoint-allowed-under-v1-mcp-client","heading":"MCP sign-in can send tokens over plain http with the v1 MCP client","tier":"notice","area":"MCP","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323\/e\/mcp-oauth-http-token-endpoint-allowed-under-v1-mcp-client","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323","markdown":"### MCP sign-in can send tokens over plain http with the v1 MCP client\n\nWith the v1 MCP client selected, MCP sign-in may now exchange or refresh tokens with a server that is not on https, with a warning\n\n**Unclear.** It is not clear how the v1 MCP client gets selected or whether it is selected by default.\n\n**What**\n\nWhen an MCP server (an outside tool connected through the Model Context Protocol) uses OAuth sign-in, Claude Code trades a sign-in code for a token, and later refreshes that token, by contacting the server's token address. With the v1 MCP client selected, Claude Code now allows that address to use plain http instead of encrypted https. This does not apply to XAA sign-ins.\n\nWhen it happens, Claude Code logs a warning that tokens and client secrets are not encrypted on that connection.\n\n**Why**\n\nThis lets sign-in work with OAuth servers that only offer plain http, but anything sent that way can be read by others on the network.\n\n- Area: MCP\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: no"}