mcp-remote: "Invalid expires_at detected" when OAuth token uses expires_in; refresh never runs
Using mcp-remote (punkpeye/mcp-remote), an OAuth provider returns an access token with expires_in and scope but no expires_at field. The logs show "WARNING: Invalid expires_at detected while reading tokens" and the token is never refreshed even after it expires. The same problem was reported when connecting to the Atlassian MCP server. Is there a fix or workaround?
Originally asked on GitHub: https://github.com/punkpeye/mcp-remote/issues/97
6 answers
The GitHub issue is marked closed (COMPLETED), but the owner's later comments show the underlying bug is still being tracked: it was consolidated into issue #273 with the same root cause, and PR #290 is the target fix. No fixed release version was named in the thread.
The owner's explanation: mcp-remote never computes expires_at from expires_in and never persists it, so the stored token cannot be judged expired and the refresh flow never runs. The reporter's token contained expires_in: 28800 and a valid exp claim, but mcp-remote still printed the warning and never refreshed. A collaborator said the faulty check was cleaned up in PR #96, but that PR was blocked upstream, so it did not resolve the problem. Another user reproduced the same failure with the Atlassian MCP server.
General advice, not from the thread: if you control the OAuth provider response or the code that stores the token before mcp-remote reads it, add an expires_at field (for example, current time plus expires_in) or configure the provider to return expires_at directly. For remote providers you do not control, the thread indicates the fix will come from PR #290.
Security note: the reporter's log sample contains an access_token value; avoid printing full tokens in logs when reproducing this issue.
Did this work for you?What a GitHub user tried on GitHub (Outcome unclear)
Reporter provided the exact OAuth token JSON (access_token, token_type: Bearer, expires_in: 28800, scope: prism) with no expires_at field; mcp-remote printed the warning and never refreshed the token even though the token had a valid exp claim.
Source: https://github.com/punkpeye/mcp-remote/issues/97 (opens external site)
Did this work for you?What @geelen tried on GitHub (Didn't work)
A collaborator said the wrong detection logic was cleaned up in PR #96, but that PR was blocked upstream, so the user-visible fix did not land from it.
Source: https://github.com/punkpeye/mcp-remote/issues/97#issuecomment-2938677442 (opens external site)
Did this work for you?What @d96litz tried on GitHub (Outcome unclear)
A user reproduced the same failure when connecting mcp-remote to the Atlassian MCP server, confirming the issue was not specific to one provider.
Source: https://github.com/punkpeye/mcp-remote/issues/97#issuecomment-2930082316 (opens external site)
Did this work for you?What @nathanloyer tried on GitHub (Outcome unclear)
A user on 2026-02-11 reported similar symptoms in the latest version and asked whether PR #96 had actually resolved the issue.
Source: https://github.com/punkpeye/mcp-remote/issues/97#issuecomment-3886382690 (opens external site)
Did this work for you?What @punkpeye tried on GitHub (Outcome unclear)
The owner consolidated the issue into #273 with the same root cause (expires_at is never computed from expires_in or persisted, so the token is never judged expired) and identified PR #290 as the target fix.
Source: https://github.com/punkpeye/mcp-remote/issues/97#issuecomment-5376215063 (opens external site)
Did this work for you?