[2hmad]

Summary

Switching accounts forced a fresh sign-in to every OAuth MCP server (Figma, Sentry, PostHog...). Claude Code keeps those tokens (mcpOAuth) in the same credential as the Claude login, so each account restored its own stale copy — often one a renewal had already consumed.

• Shared pool. MCP tokens now live once in ~/.config/ccswitch/mcp-oauth.json, shared by every account. A switch swaps only the Claude login; claudeAiOauth and every other key are restored exactly as before.
• Live state is the truth. Saving or syncing a shared account takes the live mcpOAuth as the pool, so signing out of a server sticks across switches. A credential with no mcpOAuth key at all (a fresh /login) leaves the pool alone, and ccswitch login hands the new account the shared tokens.
• Upgrade. The first run seeds the pool from every stored account plus the live credential, keeping the newest copy of each server.
• Isolation. ccswitch mcp isolate <name> gives an account its own MCP sign-ins (e.g. a client's Figma), kept in its slot and never written to the pool. ccswitch mcp share <name> reverts; ccswitch mcp shows status.
• Works for both the file and keychain backends. README, help, completion and CHANGELOG updated.

Test plan

• test/smoke.sh — 90 passed, including: tokens follow a switch, a stale stored copy loses to a renewal, upgrade gathers and keeps the newest, sign-out is not undone, a fresh credential leaves the pool alone, isolate/share keep tokens apart, Claude token untouched throughout
• test/keychain.sh — 13 passed, including MCP tokens across a keychain switch
• shellcheck -S style clean
• Upgrade dry-run against a copy of a real 3-account vault: Claude login byte-identical, all 5 MCP servers in the pool
• Manual: switch between real accounts and confirm MCP servers stay connected without re-auth
• Manual (macOS): same on the keychain backend

🤖 Generated with Claude Code