AlistGo/alist · error

failed to get admin: %w

Error message

failed to get admin: %w

What it means

Returned by authenticateToken (server/mcp/auth.go:44) when the presented token exactly matches the server's static admin token (conf.Token) but op.GetAdmin() fails. The token itself is correct — the failure is server-side, typically a database problem or a missing or underinitialized admin account, and the wrapped %w error carries the underlying cause.

Source

Thrown at server/mcp/auth.go:44

	if token == "" {
		token = r.URL.Query().Get("token")
	}

	user, err := authenticateToken(token)
	if err != nil {
		log.Debugf("MCP auth failed: %v", err)
		return ctx
	}

	return context.WithValue(ctx, userKey, user)
}

func authenticateToken(token string) (*model.User, error) {
	// Check admin static token
	if token != "" && subtle.ConstantTimeCompare([]byte(token), []byte(setting.GetStr(conf.Token))) == 1 {
		admin, err := op.GetAdmin()
		if err != nil {
			return nil, fmt.Errorf("failed to get admin: %w", err)
		}
		if err := loadRoles(admin); err != nil {
			return nil, err
		}
		return admin, nil
	}

	// No token: guest
	if token == "" {
		guest, err := op.GetGuest()
		if err != nil {
			return nil, fmt.Errorf("failed to get guest: %w", err)
		}
		if guest.Disabled {
			return nil, fmt.Errorf("guest user is disabled")
		}
		if err := loadRoles(guest); err != nil {
			return nil, err

View on GitHub (pinned to 843d9dc814)

Solutions

1. Check server logs for the wrapped cause (connection refused, no such table, etc.)
2. Verify the database connection and that first-run initialization completed (admin user exists)
3. If using SQLite, confirm no concurrent process holds a conflicting lock
4. Retry once the backing store is healthy — the static token is fine

user, err := mcpLogin(token)
if err != nil && strings.Contains(err.Error(), "failed to get admin") {
  waitForDbHealthy()
  user, err = mcpLogin(token) // one bounded retry
}

When it happens

Trigger: MCP client connects with the admin static token while the database is unreachable, not yet migrated, or the admin user row is missing (fresh install never initialized).

Common situations: Starting the MCP endpoint before completing first-time setup; database outage or locked SQLite file; restored backup missing the user table contents.

Related errors

• failed to get guest: %w
• failed to load roles: %w
• guest user is disabled
• invalid token: %w
• user not found: %w

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/cce7bec60012c4d1. Report an issue: GitHub.