Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-09-11 · high
Stale Authorization values could override fresh tokens, and the SDK now makes its own headers win.
Why now: PR #2475, which fixes this, is the guidance to follow for anyone chasing unexplained OAuth 401s on MCP clients as of September 11, 2026.
The MCP TypeScript SDK let a stale Authorization header override fresh OAuth tokens. For any MCP client authenticating against an OAuth server, an environment variable holding a placeholder credential could replace a working token. Refresh then broke once the token expired.
In StreamableHTTPClientTransport and SSEClientTransport, the SDK applied caller-supplied headers after its own. A stale Authorization value could therefore win out over a freshly refreshed token instead of losing to it.
The fix in PR #2475 names Atlassian Rovo as the case that surfaced the bug. Rovo's setup uses the same Authorization header for both API tokens and OAuth. The placeholder from an environment variable sat in the same slot as the refreshed token, and won. The client kept working until the original token expired, then started failing with 401s.
SDK-computed headers now take precedence over caller-supplied ones. Anything that sets a static Authorization header next to an OAuth refresh flow on these transports should check the update and upgrade if needed.
Each link below shares sources, entities, or timing with this story.
The Model Context Protocol's 2026-07-28 revision is the biggest change since the protocol existed. The core is now stateless request/response instead of a bidirectional stateful session. Authorization aligns with OAuth 2.1 and OpenID Connect. MCP Apps and Tasks moved under a v...
upstash/context7 (60,590 stars) shipped @upstash/[redacted] on August 7 on the 2026-07-28 protocol revision. HTTP serving is now stateless for both modern and legacy clients, and Redis-backed sessions are gone, which is a real operational simplification for anyone self-hosting...
Hudson Rock got hold of the archive and counted it. 433,909 files. 118,829 CI runner dumps traced to 2,488 corporate domains. AWS keys, Salesforce client secrets, Slack signing secrets, Azure environment variables, and AI provider API keys belonging to NVIDIA, Volkswagen, Micr...
You have one week. If you run an MCP server in production, stop what you're doing and read the release candidate. The Model Context Protocol's 2026-07-28 spec is the largest revision since the protocol launched, and the headline is architectural: the initialize/initialized han...
Cline 0.0.23 fixed one wedged MCP server blocking the rest from shutting down and leaking their processes. Copilot CLI 1.0.83-5 fixed MCP tools becoming uncallable after a server restart, and 1.0.83-4 fixed agent-configured servers disappearing after built-in sub-agent turns....
If you wrote an MCP server before July, it's on a protocol shape the maintainers have already removed. Not deprecated-with-a-migration-window. Removed from the spec. MCP lead maintainers David Soria Parra and Den Delimarsky published an updated roadmap on August 22, and the re...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.