OAuth is disabled for plugin-contributed MCP servers; use a

Error message

OAuth is disabled for plugin-contributed MCP servers; use a reviewed environment-backed header or bearer token

What it means

perform_oauth_login_for_server_with_cancel refuses to start an interactive OAuth login when the target server entry is plugin-contributed (reviewed_plugin is Some). Plugin-contributed servers run under a review model where interactive browser OAuth is out of scope; they must authenticate via reviewed environment-backed headers or bearer tokens instead, and the error says exactly that.

Source

Thrown at crates/tui/src/mcp/oauth.rs:439

    )
    .await
}

/// Run an MCP OAuth login that can be stopped by the caller.
///
/// Cancellation drops the in-flight OAuth future before this function returns,
/// which also closes its callback listener. A caller that replaces one login
/// with another should await the cancelled call before starting the replacement.
pub async fn perform_oauth_login_for_server_with_cancel(
    name: &str,
    server: &McpServerConfig,
    explicit_scopes: Option<Vec<String>>,
    callback_port: Option<u16>,
    callback_url: Option<&str>,
    cancellation_token: CancellationToken,
) -> Result<()> {
    if server.reviewed_plugin.is_some() {
        bail!(
            "OAuth is disabled for plugin-contributed MCP servers; use a reviewed environment-backed header or bearer token"
        );
    }
    run_cancellable_oauth(
        &cancellation_token,
        perform_oauth_login_for_server_inner(
            name,
            server,
            explicit_scopes,
            callback_port,
            callback_url,
        ),
    )
    .await
}

async fn run_cancellable_oauth<F, T>(cancellation_token: &CancellationToken, future: F) -> Result<T>
where

View on GitHub (pinned to 0c42157ee5)

Solutions

Configure a reviewed environment-backed Authorization header or bearer token for the plugin server instead of OAuth
If interactive OAuth is genuinely required, register the server as a regular user-level config entry (no reviewed_plugin) and log in there
Skip plugin-contributed servers when scripting OAuth login over all servers

Example fix

# before
# server came from a plugin (reviewed_plugin set); oauth login is refused

# after — register it yourself without plugin metadata, then use env-backed auth
{"servers": {"my-server": {"url": "https://example.com/mcp", "headers": {"Authorization": "Bearer ${MY_SERVER_TOKEN}"}}}}

Defensive patterns

Strategy: fallback

Validate before calling

if server.reviewed_plugin.is_some() {
    anyhow::ensure!(
        server_has_static_auth(server),
        "plugin server {name} cannot use OAuth; configure an env-backed header or bearer token"
    );
} else {
    perform_oauth_login_for_server_with_cancel(name, server, scopes, port, url, token).await?;
}

Type guard

fn is_plugin_contributed(server: &McpServerConfig) -> bool {
    server.reviewed_plugin.is_some()
}

Prevention

Skip plugin-contributed servers when scripting OAuth login across all servers
Provide reviewed env-backed Authorization headers for plugin servers from the start
Register servers needing interactive OAuth as user-level config, not via plugins

When it happens

Trigger: Invoking the OAuth login flow (with or without cancellation token, custom scopes, or callback overrides — those parameters are irrelevant to the check) against a server whose config carries reviewed_plugin metadata.

Common situations: A user tries to run OAuth login for a server that was auto-registered by an installed plugin; tooling scripts that iterate all servers and attempt login uniformly.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/4db90462a5b61340. Report an issue: GitHub.