Tools
The MCP TypeScript SDK let a stale Authorization placeholder silently override fresh OAuth tokens
modelcontextprotocol/typescript-sdk PR #2475 (merged 2026-09-11) fixes StreamableHTTPClientTransport and SSEClientTransport. Both spread caller-supplied `requestInit.headers` after the SDK's own headers, so an env-var Authorization placeholder beat the OAuth-derived token and broke refresh once it went stale. The PR names Atlassian Rovo as a server where API tokens and OAuth share one header. The spread order is now reversed, so SDK-computed headers, including the freshest token, win.
Source
↳ Follow the thread