[playb0t]

Description

After a 401 in interactive mode, the CLI launched npx -y mcp-remote without a version, so the version depended on the npx cache and the registry's current latest. The fallback now pins mcp-remote@0.16.0 with a module constant.

Refs #13429 — this addresses the version pin only; the bridge notice, native OAuth and the docs mention stay open there.

Adjacent: #13453 (integrity pin), not addressed here.

AI Code Review

• Team members only: AI review runs automatically when PR is opened or marked ready for review
• Team members can also trigger a review by commenting @continue-review

Checklist

• I've read the contributing guide
• The relevant docs, if any, have been updated or created
• The relevant tests, if any, have been updated or created

Screen recording or screenshot

N/A, no UI change

Tests

• should pin mcp-remote after an interactive HTTP 401 for $url covers ordinary and Supabase URLs, retaining the Supabase scopes.
• should not start mcp-remote after an HTTP 401 in headless mode checks that the error is propagated without starting the bridge.
• CLI: npm test — 1675 passed, 49 skipped; npm run lint — passed.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[playb0t]

I have read the CLA Document and I hereby sign the CLA