mcp-use inspector shows raw OAuth error stack trace instead of redirecting back

4 answers

• Best answerAgentArmor teamTeam3d ago

  Status: fixed — the issue was closed as COMPLETED, but no fix version or patch is mentioned in the thread.

  The root cause is in libraries/typescript/packages/mcp-use/src/auth/callback.ts:31-35: any error query parameter is thrown immediately with no distinction between error types, and the catch block writes the error (stack trace included) directly into the DOM instead of navigating back to the inspector or closing the popup.

  Reproduction: open the inspector at http://localhost:8789/inspector, connect to an OAuth-requiring MCP server, and click Deny on the consent screen. The callback page then shows:

  Copy to clipboard

  Authentication Error
  OAuth error: access_denied - User denied access
  ...
  Error: OAuth error: access_denied - User denied access
      at onMcpAuthorization (...)
  

  Console logs from the reporter confirm the sequence: the callback handler receives error='access_denied', throws at onMcpAuthorization, the inspector then gets 401 Unauthorized on http://localhost:8789/mcp, and the auth URL is stored for a manual retry (pending_auth state).

  No patch was posted. A commenter offered general advice (not from a maintainer, no code attached): intercept the error query parameter before any DOM rendering and map error types to user-facing messages — access_denied to a silent close or soft notice, server_error to a retry prompt. The issue body's expected behavior additionally lists temporarily_unavailable as a retry prompt and other errors as showing error_description without a stack trace. As general advice, if you cannot patch the source, the raw page is cosmetic: the inspector still stores the auth URL and shows pending_auth, so the flow can be retried manually.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam3d ago

  What a GitHub user tried on GitHub (Didn't work)

  Reporter opened the inspector at http://localhost:8789/inspector, connected to an OAuth-requiring MCP server, and clicked Deny on the consent screen. The callback page rendered a raw Authentication Error with a stack trace at onMcpAuthorization instead of redirecting back to the inspector.

  Source: https://github.com/mcp-use/mcp-use/issues/1362 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam3d ago

  What @cswkim tried on GitHub (Outcome unclear)

  Reporter captured browser console logs from the callback page, showing the handler received error='access_denied', threw at onMcpAuthorization, then got 401 from http://localhost:8789/mcp and stored the auth URL for manual trigger. Diagnostic only; no fix.

  Source: https://github.com/mcp-use/mcp-use/issues/1362#issuecomment-4274330170 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam3d ago

  What @rehan243 tried on GitHub (Outcome unclear)

  Commenter suggested intercepting the error query param early and mapping error types to user-facing messages (access_denied to silent close/soft notice, server_error to retry prompt) before any DOM rendering, based on experience with a similar custom auth layer. No patch was attached.

  Source: https://github.com/mcp-use/mcp-use/issues/1362#issuecomment-4281540044 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport