{"version":"2.1.323","anchor":"mcp-oauth-refresh-passes-insecure-token-endpoint-allowance-a","canonical_anchor":"mcp-oauth-refresh-passes-insecure-token-endpoint-allowance-a","heading":"MCP sign-in refresh carries the insecure token endpoint allowance","tier":"internal","area":"MCP","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323\/e\/mcp-oauth-refresh-passes-insecure-token-endpoint-allowance-a","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323","markdown":"### MCP sign-in refresh carries the insecure token endpoint allowance\n\nRefreshing an MCP server's sign-in token now passes along whether an insecure token endpoint is allowed, and can re-read the XAA pin\n\n**Unclear.** It is not stated what sets `allowInsecureTokenEndpoint` or whether a reader can set it.\n\n**What**\n\nSome MCP servers, which are outside programs that give Claude Code extra tools, need you to sign in through OAuth. OAuth uses a token that Claude Code refreshes from time to time. That refresh now passes along `allowInsecureTokenEndpoint`, which says whether the address that issues tokens may be one that is not secure. In some cases the refresh also re-reads the stored XAA pin.\n\n**Why**\n\nThis changes how sign-in security is handled for MCP servers when their tokens are refreshed.\n\n- Area: MCP\n- Names: `allowInsecureTokenEndpoint`\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: no"}