MCP: stored OAuth token is never refreshed when the server reports expiry in a 200 tool result #62199

Activity

1. opencodejr commented on Nov 5, 2026

   

   opencodejrBot

   on Nov 5, 2026

   Contributor

   More actions

   Thanks for the detailed report. I reproduced this on v2.2.5 with a local mock MCP/OAuth server built to act like the servers you describe.

   The mock issues 15-second access tokens plus a refresh token. Once a token expires, it still accepts initialize/tools/list, but tools/call returns an HTTP 200 result with isError: true and {"code":"token_expired","status":401,"action":"reauthenticate"}.

   Steps:

   1. Run opencode mcp auth mock. The token exchange succeeds and opencode mcp list shows the server as connected.
   2. Wait past the token's expiry.
   3. Start OpenCode again against the same database.

   What I saw: OpenCode reconnects using the stored, already expired access token, the server still counts as connected, and no refresh_token request ever reaches the token endpoint. The only token requests were the initial authorization-code exchanges. So the stored expiry and refresh token go unused unless the server returns a real 401. I ran out of time before capturing the failing tool call itself in the TUI.

   I haven't run the latest dev (e3b0ca6). From reading the code, refresh is still triggered only by a 401 there. The script below is the TUI part of the reproduction and needs the mock server running.

   Related: #49773 (closed, but its later comments describe the same LaunchDarkly/Homey behaviour on v2), #60269 (same missing refresh when the server answers 429 instead of 401), and #60612 (concurrent refreshes of rotating tokens).

   Reproduction script (drive.ts)

   // Repro for #62199. Prereqs: `bun mock.ts` running (mock MCP+OAuth, 15s token TTL, expiry reported as HTTP 200 isError),
   // and `opencode mcp auth mock` done against OPENCODE_DB=/workspace/repro/db.sqlite. Run with OPENCODE_DRIVE_DB=/workspace/repro/db.sqlite.
   import { Effect, Stream } from "effect"
   import { Llm, OpenCodeDriver } from "opencode-drive"
   
   
   export default OpenCodeDriver.use(
     {
       ...(process.env.OC_DEV ? { opencode: { dev: process.env.OC_DEV } } : {}),
       tui: { recording: true },
       config: { mcp: { mock: { type: "remote", url: "http://127.0.0.1:8787/mcp", codemode: false } }, permission: "allow" },
     },
     ({ ui, llm }) =>
       Effect.gen(function* () {
         // Each user turn: first request -> call the MCP tool, second request -> a text marker.
         let n = 0
         yield* llm.serve((request) => {
           const raw = JSON.stringify(request)
           if (raw.includes("You name conversations")) return Stream.make(Llm.text("MCP refresh repro"))
           const index = n++
           const tool = raw.match(/"(mock[_.]ping)"/)?.[1] ?? "mock_ping"
           console.log("REQUEST", index, "tool name in request:", tool)
           return index % 2 === 0
             ? Stream.make(Llm.toolCall({ index: 0, id: `call_${index}`, name: tool, input: {} }), Llm.finish("tool-calls"))
             : Stream.make(Llm.text(`TURN ${(index + 1) / 2} DONE`))
         })
         yield* ui.submit("call mock ping")
         yield* ui.waitFor("TURN 1 DONE", { timeout: 60000 })
         yield* ui.screenshot("first-call")
         // wait past the mock's 15s access-token lifetime
         yield* Effect.sleep("25 seconds")
         yield* ui.submit("call mock ping again")
         yield* ui.waitFor("TURN 2 DONE", { timeout: 60000 })
         yield* ui.screenshot("second-call-token-expired")
         yield* Effect.sleep("2 seconds")
       }),
   )

   Run it with opencode-drive: opencode-drive run ./drive.ts. It drives opencode from your PATH; set OC_DEV to the path of an OpenCode checkout to run that from source instead.
2. opencodejr

   added

   reproduced

   on Nov 5, 2026
3. rekram1-node

   closed this as completedin #63028on Nov 11, 2026