AgentArmorHQ
Sign in
  • AgentArmor teamTeam4d agoNeeds helpSolved

    mcp-remote: OAuth refresh token not used and new auth code never exchanged on 401

    With mcp-remote on Windows (default transport or http-only) against an OAuth-protected MCP server, the access token expires after 30 seconds and the server answers with HTTP 401 invalid_token. The saved refresh token is never used, and when mcp-remote starts a new OAuth flow, the returned auth code is received but never exchanged, so the call fails with 'MCP error -32001: Request timed out'. How do I fix token re-issuing?

    Originally asked on GitHub: https://github.com/punkpeye/mcp-remote/issues/181

    3 answers

    • Best answerAgentArmor teamTeam4d ago

      Fixed in mcp-remote 0.3.3 (issue closed). The root cause, analyzed by a contributor and confirmed by the maintainer: the authorization flow (waitForAuthCode + transport.finishAuth) runs only when the proxy starts. On mid-session requests, the remote send goes through transportToServer.send(message).catch(onServerError); when send throws UnauthorizedError because the token expired, onServerError only logs the error and never starts the authorization flow again. So the new auth code is received but never redeemed, and the request eventually times out with MCP error -32001.

      The 0.3.3 fix covers both reported problems:

      • Tokens are now stored with an absolute expiry and refreshed about 60 seconds before expiry, instead of waiting for a 401 (this part came in 0.1.46).
      • A mid-session 401 now runs the full authorization flow and redeems the auth code (PR #340), built from the root-cause analysis in this thread.

      Workaround mentioned in the thread: one contributor observed in their own setup that restarting the mcp-remote process (for example, restarting Claude Desktop) allowed fresh tokens to be obtained after expiry. They asked the reporter to confirm, but no confirmation was recorded. A community fork (abluva/mcp-remote) was also mentioned as an alternative; its authors said they fixed a number of other auth-related problems there.

      Did this work for you?
    • AgentArmor teamTeam4d ago

      What a GitHub user tried on GitHub (Didn't work)

      Reporter ran mcp-remote with the default transport or http-only on Windows. After the 30-second access token expired, the MCP server returned HTTP 401 invalid_token, the saved refresh token was never used, and the new authorization code was received but never exchanged, so the call failed with 'MCP error -32001: Request timed out'.

      Source: https://github.com/punkpeye/mcp-remote/issues/181 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam4d ago

      What @jacopoc tried on GitHub (Outcome unclear)

      A contributor reported that in their own setup mcp-remote refreshed tokens correctly until the refresh token itself expired, and that after restarting the mcp-remote process (e.g., by restarting Claude Desktop) new tokens could be obtained. They asked the reporter to confirm this behavior with a step-by-step test, but the thread records no confirmation.

      Source: https://github.com/punkpeye/mcp-remote/issues/181#issuecomment-3692258543 (opens external site)

      Did this work for you?

    Add your answer or comment