mcp-oauth-triage

Topics in the source

• MCP OAuth Triage
• Overview
• When to Use
• Features
• Usage
• Workflow
• Step 1: Collect three artifacts
• Step 2: Run the classifier

Tier: POWERFUL · Category: Engineering · Domain: AI / Auth / Connectors An OAuth-backed MCP connector rarely fails at the exchange. It fails somewhere between storing what the exchange returned and reading it back on the next call, so the visible symptom is a wall of 401s while every dashboard says the connection is healthy. The cost of guessing is high because five common faults share one symptom and need opposite fixes. Rotating a client secret does nothing when the real fault is a writer and a reader disagreeing about which key holds the token. Re-authenticating cures a poisoned auth cache for a day and hides the actual defect. This skill exists to stop that guessing: collect three artifacts, run one classifier, fix the class you actually have. Use it before touching code, and again before declaring the fix done. A connector that authenticated yesterday returns 401 or 403 today with no configuration change. The token endpoint returns 200, but the first tool call after a refresh fails. Re-authenticating fixes the symptom, and the failure returns within one token lifetime. A multi-account install returns data belonging to the wrong account. A "needs auth" state persists after a su

This is an excerpt. Refer to the complete source and its current requirements.