AlistGo/alist · error

guest user is disabled

Error message

guest user is disabled

What it means

Returned by authenticateToken (server/mcp/auth.go:59) when a tokenless MCP request maps to the guest user and that account has Disabled == true. This is an intentional policy decision, distinct from 1188: the guest row loaded fine, but the administrator has turned guest access off for this instance.

Source

Thrown at server/mcp/auth.go:59

	if token != "" && subtle.ConstantTimeCompare([]byte(token), []byte(setting.GetStr(conf.Token))) == 1 {
		admin, err := op.GetAdmin()
		if err != nil {
			return nil, fmt.Errorf("failed to get admin: %w", err)
		}
		if err := loadRoles(admin); err != nil {
			return nil, err
		}
		return admin, nil
	}

	// No token: guest
	if token == "" {
		guest, err := op.GetGuest()
		if err != nil {
			return nil, fmt.Errorf("failed to get guest: %w", err)
		}
		if guest.Disabled {
			return nil, fmt.Errorf("guest user is disabled")
		}
		if err := loadRoles(guest); err != nil {
			return nil, err
		}
		return guest, nil
	}

	// JWT token
	claims, err := common.ParseToken(token)
	if err != nil {
		return nil, fmt.Errorf("invalid token: %w", err)
	}

	user, err := op.GetUserByName(claims.Username)
	if err != nil {
		return nil, fmt.Errorf("user not found: %w", err)
	}

View on GitHub (pinned to 843d9dc814)

Solutions

1. Supply a valid token (admin static token or a user JWT) in the MCP client configuration
2. If anonymous MCP read access is desired, re-enable the guest user in the admin users panel
3. Document per-instance whether tokenless MCP is allowed

Example fix

// before
client.connect({}) // no token
// after
client.connect({ headers: { Authorization: "<admin-or-user-token>" } })

u, err := mcpGuest()
if err != nil && strings.Contains(err.Error(), "guest user is disabled") { u, err = mcpLogin(configuredToken) }

When it happens

Trigger: MCP client connects with no Authorization header (or an empty token) to an instance where the guest user is disabled in the admin panel.

Common situations: Hardened deployments that disable guest by default; leftover MCP client configuration from before guest was switched off.

Related errors

• user is not allowed to access via SFTP
• failed to get admin: %w
• failed to get guest: %w
• invalid token: %w
• user not found: %w

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/10b33250a8197a5e. Report an issue: GitHub.