ComposioHQ/composio · info

Not found

Error message

Not found

What it means

The local permissions server only recognizes the decision paths '/', '/allow', '/allow-once', and '/deny'. Any other pathname yields a 404 'Not found' plain-text response after the token check passes.

Source

Thrown at ts/packages/cli/src/services/tool-permissions.ts:1002

        res
          .writeHead(200, {
            'Content-Type': 'text/html; charset=utf-8',
            'Cache-Control': 'no-store',
          })
          .end(approvalHtml({ ...params, token }));
        return;
      }

      const decision =
        url.pathname === '/allow-session'
          ? 'allow_session'
          : url.pathname === '/allow-once'
            ? 'allow_once'
            : url.pathname === '/deny'
              ? 'deny'
              : undefined;
      if (!decision) {
        res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' }).end('Not found');
        return;
      }

      res
        .writeHead(200, {
          'Content-Type': 'text/html; charset=utf-8',
          'Cache-Control': 'no-store',
        })
        .end(completionHtml(decision));
      settle(decision);
    });

    const timeout = setTimeout(() => settle('deny'), 30_000);

    server.on('close', () => clearTimeout(timeout));
    server.on('error', error => {
      if (settled) return;
      settled = true;

View on GitHub (pinned to 64b1b85502)

Solutions

1. Use only the documented decision paths: /, /allow, /allow-once, /deny
2. Ignore favicon.ico 404s from browsers — the approval link still works
3. If you script against this server, match paths exactly (lowercase)

When it happens

Trigger: A request to an unknown path such as /favicon.ico (browser auto-request), /approve instead of /allow, or manual exploration of the local server once past token validation.

Common situations: Opening the approval link in a browser that then requests /favicon.ico (harmlessly 404ing), mistyping the decision path, or health-checkers hitting the port. This 404 is cosmetic unless your flow depends on the unknown path.

Related errors

• Forbidden
• HTTP ${response.status} ${response.statusText}
• File not readable: {file}. Please check the file permissions
• Failed to retrieve MCP server {server_id}
• Refusing to fetch: too many redirects (max {max_redirects})

AI-assisted analysis of ComposioHQ/composio@64b1b85502 (2026-08-28). Data as JSON: /api/errors/202977cdc591c7c7. Report an issue: GitHub.