August 30, 2026
Tighten MCP token signing and refresh replay
MCP access-token signing now requires its dedicated signing secret.
Read moreRead less
- The app handoff secret can no longer mint or verify access tokens. Without the dedicated secret, access-token handling fails closed.
- Concurrent refresh replay capacity resets after the active 60-second window, preserving the five-replay bound for later bursts.
- Bounded replay grace can recover a lost refresh response and uses one replay slot.
- The OAuth contract does not promise deterministic, identical token re-serving.