---
title: Tip: after the Claude Code MCP OAuth fix, revoke and re-grant the remote MCP servers that matter most | ctxsec
url: https://ctxsec.com/items/tip-revoke-remote-mcp-oauth-grants-after-claude-code-2-1-321
description: "A leaked refresh token keeps working until it expires or is revoked, and updating the client doesn't revoke anything. For remote MCP servers you connected through OAuth before 2.1.321, revoke the grant at the identity provider or the service, then sign in again."
status: "operational guidance (based on the Claude Code 2.1.321 changelog, Nov 9, 2026)"
published: 2026-11-10
---

> A leaked refresh token keeps working until it expires or is revoked, and updating the client doesn't revoke anything. For remote MCP servers you connected through OAuth before 2.1.321, revoke the grant at the identity provider or the service, then sign in again.

[← Tips & Guides](/tips) · [markdown](/items/tip-revoke-remote-mcp-oauth-grants-after-claude-code-2-1-321.md)

operational guidance (based on the Claude Code 2.1.321 changelog, Nov 9, 2026)

2026-11-10

### Tip: after the Claude Code MCP OAuth fix, revoke and re-grant the remote MCP servers that matter most

- Start with servers that reach source code, cloud consoles, mail or tickets (GitHub, Google, Microsoft, Atlassian, Slack connectors).
- Revoke in the provider's authorized-apps page, not just with `claude mcp logout`, which only clears the local copy.
- Check the provider's audit log for token use from unfamiliar IPs since you first connected.
- Remove remote MCP servers you don't run or no longer use.

Sources: [Claude Code CHANGELOG (2.1.321)](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md)