MCP SSE connect cancelled before authentication completed

Error message

MCP SSE connect cancelled before authentication completed

What it means

While establishing an SSE connection, the transport races its CancellationToken against auth.resolved_headers(), which may perform an OAuth handshake or token refresh. If the token fires first (shutdown, disable, reconnect), this bail aborts the connect cleanly instead of letting the in-flight auth work leak. It is an expected lifecycle path, not a defect.

Source

Thrown at crates/tui/src/mcp/sse.rs:100

            sse_task,
        };
        transport
            .wait_for_endpoint(&wait_cancel_token, endpoint_timeout)
            .await?;
        Ok(transport)
    }

    async fn run_sse_loop(
        client: reqwest::Client,
        url: String,
        auth: McpHttpAuth,
        tx: tokio::sync::mpsc::Sender<SseInbound>,
        cancel_token: tokio_util::sync::CancellationToken,
    ) -> Result<()> {
        let headers = tokio::select! {
            biased;
            _ = cancel_token.cancelled() => {
                anyhow::bail!("MCP SSE connect cancelled before authentication completed")
            }
            headers = auth.resolved_headers() => headers?,
        };
        let request = apply_safe_custom_headers(
            with_default_mcp_http_headers(client.get(&url), false),
            &headers,
        );
        let response = tokio::select! {
            biased;
            _ = cancel_token.cancelled() => {
                anyhow::bail!("MCP SSE connect cancelled before the request completed")
            }
            response = request.send() => response.with_context(|| {
                format!(
                    "MCP SSE connect failed (transport=http url={})",
                    mask_url_secrets(&url),
                )
            })?,

View on GitHub (pinned to 8880682c63)

Solutions

Treat it as a normal cancellation — confirm a shutdown or reconnect was actually intended
If unexpected, trace who called cancel_token.cancel() (session close, server disable) before auth finished
Avoid spawning a transport and cancelling it immediately; either cancel before starting or let the connect settle

Defensive patterns

Strategy: try-catch

Type guard

```rust
fn is_auth_cancelled(err: &anyhow::Error) -> bool {
    format!("{err:#}").contains("MCP SSE connect cancelled before authentication completed")
}
```

Try / catch

```rust
match sse_transport.connect().await {
    Err(e) if is_auth_cancelled(&e) => return Ok(()), // shutdown path: exit quietly
    other => other?,
}
```

Prevention

Cancel transports only before spawning them or after connect settles, never mid-handshake
Log cancellation bails at debug level so shutdown traces stay readable

When it happens

Trigger: Quitting the app or toggling an MCP server off while the SSE connect is still resolving OAuth headers; a reconnect loop that tears down a transport before its first connect completes.

Common situations: App shutdown during a slow OAuth token fetch; rapidly enabling/disabling MCP servers; cancellation cascades from a parent session restart.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@8880682c63 (2026-08-16). Data as JSON: /api/errors/bf9573d852b8a652. Report an issue: GitHub.