Mark rejected MCP credentials as needing re-authentication - #965
Merged
Merged
Conversation
fazxes
marked this pull request as ready for review
September 19, 2026 19:04
fazxes
force-pushed
the
fazxes/mcp-startup-notice
branch
from
September 20, 2026 02:53
4b21d22 to
a09f9a6
Compare
A server whose stored OAuth credentials fail refresh was left claiming auth=authenticated while the connection failed, so every surface reported it as a generic failure with no path forward. When the token endpoint rejects the refresh (or credentials expire with no refresh token), flip the challenge and credential flags so the shared classifier reports needs_auth everywhere: the list view and menu offer /mcp auth, capability search emits its authentication guidance, the startup notice names the server, and the model catalog stops calling it ready. The rejected credentials stay installed until a successful re-auth replaces them. Extend the expired-refresh e2e to assert the re-authentication classification in fx mcp list output.
McpRefreshRejected now fires only when the token endpoint answers 400 with invalid_grant; 429 and 5xx map to a transient McpRefreshUnavailable that fails the attempt without flipping the server to needs_auth. The mark itself is generation-guarded so a concurrent successful refresh is never overwritten by a stale rejection, and installing usable credentials clears the challenge flag so a recovered server stops asking for re-auth.
fazxes
force-pushed
the
fazxes/mcp-reauth-status
branch
from
September 20, 2026 03:27
02cb406 to
d6a1cc0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
status=needs_auth/auth=requiredwith the/mcp auth <name> --openhint, instead of showingfailedwhile still claimingauth=authenticated./mcp list, the menu, the trace report, capability search, and the model's server catalog all pick up the re-authentication state through the shared classifier.Stacked on #963.