MCP Client OAuth Refresh-Token Support Matrix (April 2026) RedCaller Team · April 30, 2026 · 10 min read MCP OAuth refresh tokens client support Claude Code Cursor VS Code mcp-remote Summary The MCP authorization specification (November 2025) mandates OAuth 2.1 with PKCE for remote MCP servers. A security best practice derived from this spec is to issue short-lived access tokens (5–60 minutes) paired with long-lived refresh tokens (30–90 days, rotated on every use). In practice, this security model is only achievable if MCP clients implement the OAuth refresh_token grant. As of April 2026, most of them do not. Metric Count Full support 0 Partial / broken 7 Not implemented 6 Unknown 1 Specification Context The MCP community formally addressed this gap through SEP-2207 (OIDC-Flavored Refresh Token Guidance), accepted as a Standards Track proposal on February 4, 2026. SEP-2207 acknowledges directly that major clients — Cursor, Claude, VS Code — are not requesting refresh tokens via the offline_access scope. It specifies that clients SHOULD include refresh_token in their grant_types client metadata and MAY augment authorization requests with offline_access when the Authorization Server lists it in scopes_supported . The MCP TypeScript SDK merged SEP-2207 on March 30, 2026, providing the client-side plumbing for scope augmentation and prompt=consent . The Python SDK implementation (PR #2039) remained open as of March 31, 2026. Most clients have not yet consumed either SDK update. Client Support Matrix Client Type refresh_token Status Notes Zed IDE Partial Auto-refresh works in HTTP transport (Mar 2026, PR #51768). DCR request omits refresh_token from grant_types , breaking strict Python SDK servers (Issue #53784). VS Code (GitHub Copilot CLI) IDE Extension Partial Silent refresh implemented (Issue #1797 closed completed Mar 10, 2026). Stale keychain entries cause repeated OAuth popups when token exceeds OS keychain size limits (Issue #2112). Cline VS Code Extension Partial OAuth 2.1 with PKCE implemented (PR #3019, closed Jan 2026). Tokens stored in VS Code SecretStorage. Refresh triggered on 401. Token management UI noted as incomplete. Continue.dev VS Code / JetBrains Extension Partial Delegates to mcp-remote on 401. Tracks EXPIRED_MCP_OAUTH errors, 24-hour expiry warnings. Not native — depends on mcp-remote bridge. Open WebUI Web UI Partial Token refresh bug fixed (PR #20138). Mid-session re-auth via toast/popup added (PR #22341). Proactive background refresh not yet implemented (Issue #19809). Goose (Block) CLI / Agent Partial Proactive refresh merged (PR #8386): checks stored credentials before unauthenticated connection, silent refresh when available. Falls back to browser auth if no refresh token. Gemini CLI CLI Partial getValidToken() has refresh logic but is only called at connection setup — not mid-session. Expired tokens cause tool failures until CLI is restarted (Issues #18895, #23776). Claude Code (CLI) CLI Not implemented refresh_token stored in ~/.claude/.credentials.json but never used. _doRefresh fails OAuth metadata discovery on non-root path URLs. 20+ linked issues. Issue #28262 closed as not_planned . Manual /mcp reconnect required. Claude Desktop Desktop App Not implemented Shares Claude Code SDK. Token persistence across sessions partially fixed (Issue #47554, Apr 2026) but auto-refresh on expiry is not implemented. Claude.ai (Web) Web UI Not implemented Custom connectors via mcp-proxy.anthropic.com never attempt token refresh. Expired tokens forwarded on tool calls, requiring daily manual reconnection (Issue #228). Cursor IDE Not implemented Tokens stored but never used for refresh. Multiple forum threads (threads #130765, #155151, #141276). Affects all recent versions (2.0.34+, 2.1.x, 3.0.x). LibreChat Web UI Not implemented Proactive refresh not implemented. Enhancement issue #12802 describes synchronized expiry storms — all users' tokens expire simultaneously, crashing the process. Amazon Q CLI CLI Not implemented Feature request #2921 describes this as a blocking issue for enterprise OAuth-enabled MCP services. Windsurf (Codeium) IDE Unknown OAuth transport supported but install docs default to PAT/static tokens. No public confirmation of auto-refresh. OAuth errors with Supabase DCR suggest refresh not wired (Issue #183). SDK & Tooling Layer Client behavior depends on the underlying SDK. SEP-2207 was accepted Feb 4, 2026, standardizing how clients request refresh tokens via offline_access scope augmentation. SDK / Tool Status What it provides Reference MCP TypeScript SDK Merged Mar 30 2026 SEP-2207: offline_access scope augmentation + prompt=consent . Client plumbing for refresh token requests. PR #1523 MCP Python SDK PR open Mar 31 2026 SEP-2207 implementation with 10 unit tests. Not yet merged. PR #2039 MCP Rust SDK In progress Feb 2026 Referenced in PR #676. Implementation ongoing. PR #676 mcp-remote (bridge) Fixes Dec 2025 Handles invalid_grant , absolute expiry timestamps, atomic ...