[rgarcia]

Summary

MCP analytics could not tell Kernel-issued (native) OAuth apart from Clerk OAuth, and native authentication failures left no analytics record at all: they return 401/403/503 straight from the native path, before the scope resolution that emits mcp_connection_scope_failure. That makes a native rollout hard to watch, since a native-only failure or drop in connections is invisible.

• $mcp_initialize events now report $mcp_auth_method: "native_oauth" for native connections. Clerk OAuth stays "oauth" and API keys stay "api_key", so existing queries keep their meaning.
• A native credential the server refuses (rejected token, revoked grant, refused scope, issuer outage) now emits mcp_connection_scope_failure with connection_credential_type: "native_oauth", the outcome (rejected or unavailable), and the response status for rejections.

The credential type is passed from the route, which already knows which path authenticated the request; /auth/context reports jwt/oauth for both OAuth kinds.

Tests

• Route: a native initialize produces $mcp_auth_method: "native_oauth"; a revoked native grant captures a rejected/401 failure; an issuer outage captures an unavailable failure.
• connectionAnalyticsFromContext maps OAuth contexts to the caller's credential type.
• bunx tsc --noEmit and bun test (1190 tests) pass.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Nov 12, 2026 9:05pm UTC