AgentArmorHQ
Sign in
Supply chain

Update MCP SDK and Inspector, then retest OAuth flows

AgentArmorHQ team2 min read

You will upgrade the MCP Python SDK and MCP Inspector, then rerun the fresh login and expired-token paths. This helps you confirm connections stop looping and stored tokens behave as expected.

  1. Verify versionsConfirm Inspector 0.17.0+ and pinned Python SDK
  2. Clear OAuth stateRemove stored tokens before retesting
  3. Fresh login testComplete the guided flow to a token
  4. Expired token testCheck proactive refresh vs first-request 401
  5. Scope checkMatch requested scopes to the AS config

Why it matters

The Inspector kept requesting new authorization codes after a successful JWT exchange, and the fix landed in Inspector 0.17.0 (issue #633 (opens external site)). The Python SDK still has an open bug where an expired stored token is treated as valid forever, so the first request gets a 401 and the client falls back to full re-authentication (issue #1318 (opens external site)). Upgrading fixes the Inspector loop, but the SDK expiry case needs its own retest.

Steps

  1. Check which Inspector version is actually running. Older releases still show the loop, and the @latest tag pointed to a looping build at one point. Install 0.17.0 or newer and confirm the version after install.

  2. Clear the stored OAuth state in the Inspector's OAuth settings before retesting. Run the OAuth guided flow step by step until it completes with a token, and only after that click Connect.

  3. Upgrade the Python SDK in your project environment, then pin the exact version you tested with in your lockfile or requirements file. Confirm the installed version matches the pin.

  4. Retest a fresh login. Connect a client with no stored tokens, complete the flow, and confirm the server accepts the token on the first request.

  5. Retest an expired-token case. Store a token whose expiry has passed and check whether the client refreshes it proactively or hits a 401 first. If it returns a 401 on the first request, you are hitting the expiry bug in issue #1318 (opens external site), so plan a workaround or wait for the fix.

  6. If you run a proxy or external authorization server, retest refresh against the real token endpoint. Watch for refresh requests going to server_url + /token instead of the provider's token URL, which is the second bug in the same issue.

  7. Check the scopes your server requests against the authorization server configuration. A 401 for invalid requested scopes will not self-recover, and the Inspector restarts the full flow instead of refreshing.

Common mistakes

  • Testing only with a fresh login and assuming refresh works. Expired-token behavior is a separate path.
  • Assuming the Inspector fix covers the Python SDK. The SDK bugs are tracked separately and were still open in the linked thread.
  • Logging bearer tokens while debugging. Redact them in logs and traces.
  • Skipping the version check after upgrading. Confirm what is actually running.

Checklist

0 of 8 done

Sources

  1. Can FastMCP delegate OAuth to a third-party authorization server instead of acting as one?
  2. Why does MCP Python SDK re-authenticate on first request instead of refreshing expired stored tokens?
  3. MCP Inspector stuck in infinite OAuth loop after receiving JWT token - how to fix?
Was this guide useful?