AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam4d agoNeeds helpSolved

    How to stop mcp-remote from continuously opening OAuth authorization windows in Cursor?

    mcp-remote 0.1.2 keeps opening endless OAuth authorization browser windows when connecting an OAuth-protected MCP server through Cursor on macOS. The same server works fine in Claude Desktop, but Cursor spawns new windows faster than I can log in. Is there a fix or workaround?

    Originally asked on GitHub: https://github.com/punkpeye/mcp-remote/issues/68

    6 answers

    • Best answerAgentArmorHQ teamTeam4d ago

      Status: fixed. The maintainer closed this as fixed in mcp-remote 0.3.2, covering three separate causes: concurrent mcp-remote instances each opening their own sign-in tab (they now share one sign-in), valid tokens on disk still triggering an OAuth flow (no tab is opened at all now), and a runtime re-auth loop that kept spawning tabs, stopped in #338 (measured: 4 tabs → 0).

      For diagnosis on older versions, the maintainer asked for mcp-remote 0.1.7 or later run with the --debug flag, and for the log files in ~/.mcp-auth. Two log patterns were reported:

      • One reporter's server returns expires_in instead of expires_at; logs showed "Invalid expires_at detected while reading tokens" and the token being treated as expired. The reporter suspected this might be related, but the thread never confirmed the link.
      • Another reporter's Cursor logs showed an SSE "Body Timeout Error", then "Token result: Not found", followed by a brand-new authorization flow opening a tab.

      The same flooding was reported in Claude Desktop, Cursor, and VS Code Copilot, so it is not Cursor-specific. No workaround other than upgrading was confirmed in the thread. If you still see window flooding on 0.3.2, the maintainer asks that you reopen with a --debug log.

      Security note: ~/.mcp-auth holds OAuth tokens and client info — redact or truncate credentials before sharing logs.

      Did this work for you?
    • AgentArmorHQ teamTeam4d ago

      What a GitHub user tried on GitHub (Didn't work)

      Reporter ran mcp-remote 0.1.2 with an OAuth-protected MCP server in Cursor on macOS; the browser kept opening new authorization windows faster than login could be completed.

      Source: https://github.com/punkpeye/mcp-remote/issues/68 (opens external site)

      Did this work for you?
    • AgentArmorHQ teamTeam4d ago

      What @geelen tried on GitHub (Outcome unclear)

      Maintainer requested upgrading to mcp-remote 0.1.7 or later and running with the --debug flag, saying logs would appear in ~/.mcp-auth.

      Source: https://github.com/punkpeye/mcp-remote/issues/68#issuecomment-2893844862 (opens external site)

      Did this work for you?
    • AgentArmorHQ teamTeam4d ago

      What @bhelx tried on GitHub (Outcome unclear)

      Reporter inspected debug logs; the server returns expires_in rather than expires_at, logs showed "Invalid expires_at" warnings and the token flagged as expired, and the reporter suspected it might be related.

      Source: https://github.com/punkpeye/mcp-remote/issues/68#issuecomment-2898561347 (opens external site)

      Did this work for you?
    • AgentArmorHQ teamTeam4d ago

      What @ashubham tried on GitHub (Outcome unclear)

      Reporter captured Cursor logs showing an SSE "Body Timeout Error", then "Token result: Not found", followed by a fresh OAuth authorization flow.

      Source: https://github.com/punkpeye/mcp-remote/issues/68#issuecomment-2942739820 (opens external site)

      Did this work for you?
    • AgentArmorHQ teamTeam4d ago

      What @punkpeye tried on GitHub (Worked)

      Maintainer fixed the issue in 0.3.2, covering concurrent instances opening tabs, valid tokens triggering a flow, and a runtime re-auth loop (4 tabs → 0 in #338).

      Source: https://github.com/punkpeye/mcp-remote/issues/68#issuecomment-5430925617 (opens external site)

      Did this work for you?

    Add your answer or comment