@@ -2151,6 +2151,29 @@ func (sc *ServerConfig) IsAutoApproveToolChanges() bool {
 	return sc.EffectiveTrustMode() == TrustModeAuto
 }
 
+// HasStaticAuthorizationHeader reports whether the server is configured to
+// authenticate with a static credential in the `Authorization` header (name
+// matched case-insensitively, value non-blank).
+//
+// OAuth and a static Authorization header are mutually exclusive on the wire:
+// the OAuth transport populates that very header, and the headers-auth
+// strategy runs before OAuth is ever attempted. A config that declares one
+// has therefore stopped using the other, which lets the server projection
+// ignore an OAuth token record left behind by a previous OAuth login
+// (GH #1172) without a heuristic on other header names. A nil receiver has no
+// headers.
+func (sc *ServerConfig) HasStaticAuthorizationHeader() bool {
+	if sc == nil {
+		return false
+	}
+	for name, value := range sc.Headers {
+		if strings.EqualFold(name, "Authorization") && strings.TrimSpace(value) != "" {
+			return true
+		}
+	}
+	return false
+}
+
 // IsToolAllowedByConfig reports whether toolName passes the server's static
 // enabled_tools / disabled_tools filter. Returns true when neither list is set.
 func (sc *ServerConfig) IsToolAllowedByConfig(toolName string) bool {
 
@@ -0,0 +1,41 @@
+package config
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// GH #1172: the server-list projection must be able to tell "this server
+// authenticates with a static Authorization header" apart from "this server
+// may use OAuth via autodiscovery" without consulting stored tokens.
+func TestServerConfig_HasStaticAuthorizationHeader(t *testing.T) {
+	cases := []struct {
+		name    string
+		headers map[string]string
+		want    bool
+	}{
+		{"nil headers", nil, false},
+		{"empty headers", map[string]string{}, false},
+		{"canonical Authorization", map[string]string{"Authorization": "Bearer abc"}, true},
+		{"lower-case authorization", map[string]string{"authorization": "Bearer abc"}, true},
+		{"mixed-case AUTHORIZATION", map[string]string{"AUTHORIZATION": "Basic xyz"}, true},
+		{"empty Authorization value is not a credential", map[string]string{"Authorization": ""}, false},
+		{"blank Authorization value is not a credential", map[string]string{"Authorization": "   "}, false},
+		{"unrelated header only", map[string]string{"X-Client-Version": "1.0"}, false},
+		{"api-key style header is not Authorization", map[string]string{"X-API-Key": "k"}, false},
+		{"Proxy-Authorization is not the resource credential", map[string]string{"Proxy-Authorization": "Basic x"}, false},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			sc := &ServerConfig{Name: "s", URL: "https://example.invalid/mcp", Headers: tc.headers}
+			assert.Equal(t, tc.want, sc.HasStaticAuthorizationHeader())
+		})
+	}
+
+	t.Run("nil receiver", func(t *testing.T) {
+		var sc *ServerConfig
+		assert.False(t, sc.HasStaticAuthorizationHeader())
+	})
+}
@@ -2364,11 +2364,16 @@ func (r *Runtime) GetAllServers() ([]map[string]interface{}, error) {
 				}
 			}
 
+			// GH #1172: a token record left behind by an earlier OAuth login
+			// is not evidence about a server that now authenticates with a
+			// static Authorization header — see StoredOAuthTokenInPlay.
+			tokenInPlay := r.StoredOAuthTokenInPlay(serverStatus.Name, serverStatus.Config)
+
 			// Check if server has valid OAuth token in storage
 			// IMPORTANT: This runs for ALL servers with a URL, including autodiscovery servers
 			// PersistentTokenStore uses serverKey (name + URL hash), not just server name
 			// We need to generate the same key format: "servername_hash16"
-			if url != "" && r.storageManager != nil {
+			if url != "" && r.storageManager != nil && tokenInPlay {
 				r.logger.Debug("Checking OAuth token in storage",
 					zap.String("server", serverStatus.Name),
 					// #1158: the configured upstream URL routinely carries a
@@ -2655,13 +2660,11 @@ func (r *Runtime) GetAllServers() ([]map[string]interface{}, error) {
 		}
 
 		// T032: Wire refresh state into health calculation (Spec 023)
-		if r.refreshManager != nil {
-			if refreshState := r.refreshManager.GetRefreshState(serverStatus.Name); refreshState != nil {
-				healthInput.RefreshState = health.RefreshState(refreshState.State)
-				healthInput.RefreshRetryCount = refreshState.RetryCount
-				healthInput.RefreshLastError = refreshState.LastError
-				healthInput.RefreshNextAttempt = refreshState.NextAttempt
-			}
+		if refreshState := r.HealthRefreshState(serverStatus.Name, serverStatus.Config); refreshState != nil {
+			healthInput.RefreshState = health.RefreshState(refreshState.State)
+			healthInput.RefreshRetryCount = refreshState.RetryCount
+			healthInput.RefreshLastError = refreshState.LastError
+			healthInput.RefreshNextAttempt = refreshState.NextAttempt
 		}
 
 		healthStatus := health.CalculateHealth(healthInput, healthConfig)
@@ -2914,6 +2917,55 @@ func (r *Runtime) TriggerOAuthLoginQuick(serverName string) (*core.OAuthStartRes
 	return result, nil
 }
 
+// StoredOAuthTokenInPlay reports whether a record in the oauth_tokens bucket
+// (and the RefreshManager schedule built from it) is evidence about the named
+// server's authentication state (GH #1172).
+//
+// It is not when the server has no `oauth` block and carries a static
+// Authorization header: the headers-auth strategy runs first and OAuth is
+// never attempted while it works, and OAuth would populate that very header,
+// so a token left behind by an earlier OAuth login (autodiscovery servers have
+// no `oauth` block whose removal could have cleared it) is stale. Consulting
+// it used to report a connected, tool-serving upstream as unhealthy / "Token
+// expired" / login for as long as the record existed, and its failed refresh
+// schedule as "Refresh token expired". The record is left alone (logout still
+// removes it); it is simply not consulted.
+//
+// The live connection has the final say: if the configured header was
+// rejected and the OAuth strategy rescued the connection with that very
+// token, the token IS in play and is reported as for any other OAuth server.
+// A nil config (server known only to the state view) keeps the historical
+// behaviour of consulting the record.
+func (r *Runtime) StoredOAuthTokenInPlay(name string, cfg *config.ServerConfig) bool {
+	if cfg == nil || cfg.OAuth != nil || !cfg.HasStaticAuthorizationHeader() {
+		return true
+	}
+	return r.serverConnectedWithOAuth(name)
+}
+
+// HealthRefreshState returns the RefreshManager state to feed into the health
+// calculator for the named server, or nil when there is none or when the token
+// it rides on is not in play for this server (StoredOAuthTokenInPlay). Every
+// CalculateHealth call site must read refresh state through this, or the
+// REST, MCP and tray surfaces disagree about a header-authenticated server.
+func (r *Runtime) HealthRefreshState(name string, cfg *config.ServerConfig) *oauth.RefreshStateInfo {
+	if r.refreshManager == nil || !r.StoredOAuthTokenInPlay(name, cfg) {
+		return nil
+	}
+	return r.refreshManager.GetRefreshState(name)
+}
+
+// serverConnectedWithOAuth reports whether the named server's live connection
+// was authenticated by the OAuth strategy (GH #1172). False when the upstream
+// manager or the client is absent, or the client is not connected that way.
+func (r *Runtime) serverConnectedWithOAuth(name string) bool {
+	if r.upstreamManager == nil {
+		return false
+	}
+	client, exists := r.upstreamManager.GetClient(name)
+	return exists && client != nil && client.ConnectedWithOAuth()
+}
+
 // TriggerOAuthLogout implements RuntimeOperations interface for management service.
 // Clears OAuth token and disconnects a specific server.
 func (r *Runtime) TriggerOAuthLogout(serverName string) error {
@@ -2938,6 +2990,14 @@ func (r *Runtime) TriggerOAuthLogout(serverName string) error {
 		return fmt.Errorf("failed to clear OAuth token: %w", err)
 	}
 
+	// GH #1172: the refresh schedule rides on the token that was just removed.
+	// Left behind, a failed schedule kept reporting the logged-out server as
+	// "Refresh token expired" instead of "Logged out" — the server-removal path
+	// already does this, logout did not.
+	if r.refreshManager != nil {
+		r.refreshManager.OnTokenCleared(serverName)
+	}
+
 	// Disconnect the server to force re-authentication
 	if err := r.upstreamManager.DisconnectServer(serverName); err != nil {
 		r.logger.Warn("Failed to disconnect server after OAuth logout",