Remove the oauth_or_token fallback mode from MCP authentication.
MCP now supports only oauth for production agent connections and token for legacy/local static-token access. In oauth mode, MCP_TOKEN is no longer accepted, so external agents must use a valid OAuth/OIDC JWT access token with the required scope.
Update env examples and documentation to recommend MCP_AUTH_MODE=oauth, add a dedicated MCP OAuth README, and cover the new behavior with tests.
Remove the oauth_or_token fallback mode from MCP authentication.
MCP now supports only oauth for production agent connections and token for legacy/local static-token access. In oauth mode, MCP_TOKEN is no longer accepted, so external agents must use a valid OAuth/OIDC JWT access token with the required scope.
Update env examples and documentation to recommend MCP_AUTH_MODE=oauth, add a dedicated MCP OAuth README, and cover the new behavior with tests.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Remove the oauth_or_token fallback mode from MCP authentication.
MCP now supports only oauth for production agent connections and token for legacy/local static-token access. In oauth mode, MCP_TOKEN is no longer accepted, so external agents must use a valid OAuth/OIDC JWT access token with the required scope.
Update env examples and documentation to recommend MCP_AUTH_MODE=oauth, add a dedicated MCP OAuth README, and cover the new behavior with tests.