claude mcp login & /rewind: The Two Claude Code June 2026 Features Worth Your Attention

The biggest Claude Code releases get their own blog post. The smaller ones — the ones that actually change your daily workflow — slip by unnoticed in the changelog. Week 26 (June 22–26, 2026, versions v2.1.185 through v2.1.193) was one of those weeks. Two features shipped that solve problems every Claude Code user hits: manual token management for MCP servers, and losing your working context every time you run /clear.

Neither feature is glamorous. Neither made a keynote. Both are worth five minutes of your time to configure once and never think about again.

What shipped in Week 26

The full changelog is on the Claude Code What's New page, but the three items worth pulling out are:

• claude mcp login / claude mcp logout — OAuth-native authentication for MCP servers that support it. Replaces the pattern of manually pasting bearer tokens into claude_desktop_config.json.
• /rewind — Restores the last known good context state after a /clear, so you can wipe the conversation without losing your active file context and working memory.
• Background subagent permission surfacing — When a background subagent needs a permission approval, it now surfaces that request in the parent terminal rather than silently blocking.

claude mcp login: OAuth done right

If you've added more than two or three MCP servers to Claude Code, you know the pattern: find the server's auth docs, generate a token, open ~/.config/claude/claude_desktop_config.json, paste the token into the right JSON key, and restart the client. Then do it again every 90 days when the token expires, except you can't remember which server it was or where the token lives.

claude mcp login replaces this with a browser-based OAuth flow that stores credentials in the system keychain. The command signature is:

# authenticate with an OAuth-capable MCP server
claude mcp login <server-name>

# the CLI opens your browser to the server's OAuth page
# you approve, the token lands in the keychain
# claude code picks it up automatically — no config edit needed

# check login state for all connected servers
claude mcp status

# log out (clears the keychain entry)
claude mcp logout <server-name>

The feature requires the MCP server to implement OAuth 2.0 with PKCE. Servers that still use static API keys continue to work the old way —claude mcp loginskips them silently and reports "this server uses static auth."

The practical difference: you run claude mcp login githubonce when you first set up the server. Token refresh happens automatically in the background — Claude Code checks expiry before each session and silently refreshes if the token is within 10% of its TTL. You'll only see the browser flow again if you explicitly log out or if the server revokes access.

Token lifecycle and rotation

Under the hood, Claude Code stores the OAuth access token, refresh token, and expiry metadata in the OS keychain (Keychain on macOS, libsecret on Linux, Windows Credential Manager). The server name is the keychain entry key, so you can inspect or delete entries with system tools if something goes wrong.

# verify the keychain entry exists
security find-generic-password -a claude-code -s "mcp-github" -w

# delete it manually if you need to force re-auth
security delete-generic-password -a claude-code -s "mcp-github"

Token refresh is built into the MCP connection handshake. When Claude Code starts a session and connects to registered servers, it checks each token's expiry before opening the connection. If the token has less than 10% of its original TTL remaining, Claude Code requests a refresh using the stored refresh token. This happens before the first tool call — you won't hit a mid-session auth failure on a long agentic run.

# if you want to force re-auth without waiting for expiry
claude mcp logout github
claude mcp login github

/rewind: context after /clear

/clearwipes the conversation history to free context window space. It's the right move when a long session has drifted and you want a clean slate — but the cost is that Claude Code also loses its working memory: which files you were editing, what the active branch was, what decisions were made an hour ago.

/rewind is a single-step undo for that. It restores the last checkpoint that Claude Code saved before the /clear — not the full conversation, but the structured working state: open files, active tasks, and the summary of decisions from the prior session.

# clear the conversation (saves a checkpoint before clearing)
/clear

# later in the same session, restore the working context
/rewind

# rewind accepts a step count if you've cleared multiple times
/rewind 2    # restore the state from two /clears ago

What gets restored vs what stays gone:

• Restored: the working file set (what was open), the branch and git status at the time of clear, and the structured task summary Claude Code maintains in session state.
• Gone: the conversation transcript itself — all the turns, drafts, and intermediate reasoning. The context window is still clean. /rewind restores metadata, not messages.

The most useful pattern is clearing mid-task when the conversation has ballooned, then rewinding to pick up the file context without re-explaining the whole project from scratch. Claude Code reads the restored state and continues from "here's what we were doing" without the overhead of the prior conversation.

Combining them in a daily workflow

Here's how these two features fit together in a real daily workflow:

# morning: all MCP servers auth automatically (tokens refreshed in background)
claude

# 3 hours in: conversation is 800+ tokens long, starting to drift
# clear it without losing your place
/clear

# keep working with the same file context — no re-explanation needed
/rewind

# if you need to check which MCP servers are connected + their auth state
claude mcp status

# end of day: explicitly log out of servers with sensitive scopes
claude mcp logout notion

The combination cuts two of the friction points that make long Claude Code sessions feel expensive: the authentication overhead at the start of a new day, and the loss of working context when you need to clear the conversation to keep the model focused.

Skills for the new auth model

On skills-hub.ai, the mcp-connection-audit skill in the ops category integrates with the new claude mcp status output to audit your MCP server connections: checks auth expiry, flags servers using static tokens that could migrate to OAuth, and verifies tool availability for each connected server.

# install the MCP connection audit skill
npx @skills-hub-ai/cli install mcp-connection-audit

# run it (outputs a table of servers, auth type, expiry, and tool count)
/mcp-connection-audit

For teams using Claude Enterprise's zero-touch admin-provisioned MCP connectors (Okta, Asana, Atlassian, Linear), the mcp-enterprise-auth skill covers the admin-side setup — distinct from the developer-facing claude mcp login covered here.

What's next

The Claude Code changelog has been moving at roughly three releases per day through June. The next items flagged as in-progress in the public roadmap:

• MCP server health monitoring — Claude Code will surface connection errors inline during sessions rather than only at startup, with a reconnect command.
• Session snapshots — a disk-persistent version of the /rewind checkpoint, allowing context restore across restarts (opt-in, stored encrypted in ~/.config/claude/snapshots/).
• Scoped MCP logins — authenticating to an MCP server with a narrower scope than its default (read-only GitHub access for code review subagents vs full write access for implementation subagents).

If you're tracking these, the fastest signal is the What's New page — it updates daily. The skills-hub changelog also pulls Claude Code release notes automatically.

# npm global install
npm update -g @anthropic-ai/claude-code

# or via Claude Code's own update command
claude update

Neither claude mcp login nor /rewindrequires any configuration changes — they're available immediately after updating. The OAuth flow triggers automatically when you first try to connect to a server that advertises OAuth support in its manifest.