AlistGo/alist · error

failed to get guest: %w

Error message

failed to get guest: %w

What it means

Returned by authenticateToken (server/mcp/auth.go:56) when an MCP request arrives with no token (guest path) and op.GetGuest() fails. Like 1187 this is a server-side lookup failure, not an auth decision — the guest user record could not be loaded from the database, and the wrapped error explains why.

Source

Thrown at server/mcp/auth.go:56

func authenticateToken(token string) (*model.User, error) {
	// Check admin static token
	if token != "" && subtle.ConstantTimeCompare([]byte(token), []byte(setting.GetStr(conf.Token))) == 1 {
		admin, err := op.GetAdmin()
		if err != nil {
			return nil, fmt.Errorf("failed to get admin: %w", err)
		}
		if err := loadRoles(admin); err != nil {
			return nil, err
		}
		return admin, nil
	}

	// No token: guest
	if token == "" {
		guest, err := op.GetGuest()
		if err != nil {
			return nil, fmt.Errorf("failed to get guest: %w", err)
		}
		if guest.Disabled {
			return nil, fmt.Errorf("guest user is disabled")
		}
		if err := loadRoles(guest); err != nil {
			return nil, err
		}
		return guest, nil
	}

	// JWT token
	claims, err := common.ParseToken(token)
	if err != nil {
		return nil, fmt.Errorf("invalid token: %w", err)
	}

	user, err := op.GetUserByName(claims.Username)
	if err != nil {

View on GitHub (pinned to 843d9dc814)

Solutions

1. Check server logs for the wrapped database error
2. Ensure initialization and migration ran so the guest user exists
3. Restore DB connectivity, then retry the tokenless request
4. If guest access was never intended, send a real token so this path is not used

if err != nil && strings.Contains(err.Error(), "failed to get guest") { backoff.Retry(mcpCall, 3) }

When it happens

Trigger: MCP client connects with an empty Authorization header while the database is down, the guest user row is missing, or migrations have not run.

Common situations: Fresh deployments where setup did not seed the guest account; DB outages surfacing here first because unauthenticated MCP calls hit this path before any other.

Related errors

• failed to get admin: %w
• failed to load roles: %w
• guest user is disabled
• invalid token: %w
• user not found: %w

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/ae6ef4f275fbaa00. Report an issue: GitHub.