Tip: after the Claude Code MCP OAuth fix, revoke and re-grant the remote MCP servers that matter most
- Start with servers that reach source code, cloud consoles, mail or tickets (GitHub, Google, Microsoft, Atlassian, Slack connectors).
- Revoke in the provider's authorized-apps page, not just with
claude mcp logout, which only clears the local copy. - Check the provider's audit log for token use from unfamiliar IPs since you first connected.
- Remove remote MCP servers you don't run or no longer use.
Sources: Claude Code CHANGELOG (2.1.321)