Follow Discord
Sweep 12 Nov 2026 · 23:00Z Build v2.1.323 540 read Stable v2.1.311 Latest v2.1.323 Next v2.1.323 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeReleasesv2.1.323entry #560

Claude Code v2.1.323 ·

MCP sign-in refresh carries the insecure token endpoint allowance

Refreshing an MCP server's sign-in token now passes along whether an insecure token endpoint is allowed, and can re-read the XAA pin

Under the hood No documentation found Bug Fixes
JSON All of v2.1.323
Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
MCPArea: what it touches
Bug FixesKind: in v2.1.323,
Bug FixesSection of the release

Unclear It is not stated what sets allowInsecureTokenEndpoint or whether a reader can set it.

What

Some MCP servers, which are outside programs that give Claude Code extra tools, need you to sign in through OAuth. OAuth uses a token that Claude Code refreshes from time to time. That refresh now passes along allowInsecureTokenEndpoint, which says whether the address that issues tokens may be one that is not secure. In some cases the refresh also re-reads the stored XAA pin.

Why

This changes how sign-in security is handled for MCP servers when their tokens are refreshed.

Read from
Names in the bundleallowInsecureTokenEndpoint
How sure we are
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubtIt is not stated what sets `allowInsecureTokenEndpoint` or whether a reader can set it.

See this entry in the whole of v2.1.323 →

Feedback