[BUG] 2.1.9 regression: Uncontrolled request spam to /mcp and OAuth endpoints by Claude Code
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
We operate Context7, Claude Code 2.1.9 is sending an extremely excessive number of requests to our /mcp and /oauth endpoints, effectively DDoS-ing our infrastructure. This is not a minor performance issue — our DDoS protection has been triggered multiple times, causing service degradation for our legitimate users.
The timestamp of the Claude Code 2.1.9 release correlates exactly with a sudden, massive spike in traffic to our servers. This is causing real operational harm to our platform.
We've checked and the timestamp of the release of Claude Code 2.1.9 matches exactly with the increase in the load of our servers.
What Should Happen?
Claude Code should make requests to MCP and OAuth endpoints only when necessary — not thousands of requests in a matter of minutes. Whatever polling, retry logic, or connection mechanism was changed in 2.1.9 needs immediate attention.
Error Messages/Logs
<img width="1453" height="626" alt="Image" src="https://github.com/user-attachments/assets/d417086e-c4f7-47cf-b082-57b7d4d53dee" />
You can see the request counts in the last 30 minutes.
<img width="1479" height="672" alt="Image" src="https://github.com/user-attachments/assets/601a8f84-4ec6-4314-affe-35b68acfd176" />
Affected endpoints:
/mcp/.well-known/oauth-authorization-server/mcp/.well-known/openid-configuration/mcp/mcp/.well-known/openid-configuration
Steps to Reproduce
Not directly reproducable, but we can see from our firewall requests that some clients sends thousands of requests in few minutes.
Claude Model
Not sure / Multiple models
Is this a regression?
Yes, this worked in a previous version
Last Working Version
2.1.8
Claude Code Version
2.1.9
Platform
Anthropic API
Operating System
macOS
Terminal/Shell
Terminal.app (macOS)
Additional Information
From our firewall and server logs:
Multiple Claude Code 2.1.9 user agents are sending thousands of requests within minutes
This traffic pattern is indistinguishable from a DDoS attack
Our rate limiting and DDoS protection have been triggered, impacting legitimate users
This began exactly when 2.1.9 was released and did not occur with 2.1.8
We urge you to treat this as a high-priority issue. MCP server operators should not have their infrastructure overwhelmed by the client implementation. Please consider a hotfix or rollback of whatever change caused this regression.
5 Comments
This is also happening to our orgs MCP server. I had 4 Claude tabs alive and was spamming our servers with 0-50 OAuth requests per second. Effectively a DDoS
2.1.11 is out with a fix for this issue!
Thanks for the patch @ashwin-ant . Just to confirm do we need to only block 2.1.9 or 2.1.10 as well ?
2.1.10 also contains the bug, but it's unlikely many users updated to it. Blocking both would be safest though, yeah.
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.