Repository navigation
CLI stored-auth flags (--use-stored-auth, --list-stored-auth, --wait-for-auth) miss tokens stored under byIssuer #2517
Description
Problem
The CLI's stored-auth flags can't see a token the shared OAuth store actually holds:
--use-stored-authexits3withno_stored_token, and its message lists the very URL it failed to match under "Stored keys".--list-stored-authreturns"storedServerUrls": [].--wait-for-authgoes through the same lookup (findStoredToken), so going by the code it waits until it times out even after the token lands. I haven't run this one.
The lookups in clients/cli/src/cli.ts read the token at the server level: state.tokens?.access_token / state.tokens?.refresh_token (on v2/main: L325 findStoredToken, L388, L1010 --list-stored-auth, L1120–1121 --use-stored-auth). Since the OAuth store was re-keyed per issuer (#1625), acquired tokens are stored at servers[url].byIssuer[activeIssuer].tokens, so none of these lookups ever matches. --stored-auth-only is unaffected because it goes through the normal auth provider path, which does read byIssuer.
Found while smoke testing #2482, where it reproduced identically on v2/main (30a9a897) and on the PR head (fc55e11a). So it is not caused by that PR. The PR does change where the tokens live, since they move to the secret store and are joined back on read, so a fix should read the joined view.
Reproduce
- Start an OAuth test server:
node test-servers/build/server-composable.js --config test-servers/configs/oauth-revocation-http.json(:8083). - With an isolated
MCP_STORAGE_DIR, complete an interactive CLI login:mcp-inspector --cli --server-url http://localhost:8083/mcp --method tools/list. - Check the token is there:
--stored-auth-only --method tools/listsucceeds, andoauth.jsonshowsservers["http://localhost:8083/mcp"].byIssuer["http://localhost:8083"].tokens. mcp-inspector --cli --list-stored-authprintsstoredServerUrls: [].mcp-inspector --cli --server-url http://localhost:8083/mcp --use-stored-auth --method tools/listexits 3 with{"error":{"code":"no_stored_token",…"Stored keys: http://localhost:8083/mcp."}}.
Expected
--list-stored-authlists the URL.--use-stored-authrefreshes (or injects) the active issuer's token and succeeds.--wait-for-authreturns as soon as the token lands.- The refresh write-back persists the rotated tokens under the active issuer.
The existing stored-auth tests should cover the byIssuer shape, so this can't regress silently again.
Activity
cliffhall commentedon Sep 27, 2026
Priority: Medium (8). Severity 3: the CLI's stored-auth handoff is broken, and the only workaround is partial (
--stored-auth-onlyworks for reuse, but there is no refresh or wait). Urgency 3: wanted this milestone, since #2482 moves where tokens live and the fix should target the joined view. Bonuses: +1bug, +1 milestoned.Ben-Home commentedon Sep 29, 2026
felixlheureux commentedon Oct 2, 2026
Additional real-world reproduction from VibeEasy development acceptance against published Inspector 2.9.0:
--stored-auth-onlyprocesses negotiated MCP2026-07-28, discovered 26 tools, and successfully invokedprojects.list.--list-stored-authstill returned no server URLs.--use-stored-authexited 3 withno_stored_token.The published 2.9.0 bundle and current main both show the same mismatch: shared OAuth storage writes issuer-bound credentials under
servers[serverUrl].byIssuer[issuer], while CLI stored-auth helpers still read legacy top-levelstate.tokens/state.clientInformation.The fix should reuse the existing issuer-aware storage semantics rather than flattening credentials:
--wait-for-authand--list-stored-authmust use the same resolver.Regression coverage requested:
--list-stored-auth;--use-stored-authreuses issuer-scoped access credentials;--wait-for-authrecognizes newly persisted issuer-scoped credentials;VibeEasy did not inject bearer tokens, inspect raw OAuth files, or modify its Auth implementation to get around this. The acceptance runner remains blocked on this upstream behavior.
Merge pull request #2572 from modelcontextprotocol/v2/fix/2517-cli-st…
cliffhall commentedon Oct 5, 2026
Fixed by #2572, merged into
v2/main.fix(cli): read stored-auth tokens from the active issuer slot