OAuth logout is only supported for URL-based MCP servers

Error message

OAuth logout is only supported for URL-based MCP servers

What it means

The logout path mirrors the login path: OAuth tokens are keyed by server URL (delete_oauth_tokens(name, url)), and a stdio/command server has no URL and never obtained OAuth tokens (oauth.rs:561). The bail happens before any storage lookup.

Source

Thrown at crates/tui/src/mcp/oauth.rs:561

        http_headers,
        env_headers,
        scopes,
        oauth_client_id,
        oauth_resource,
        callback_port,
        callback_url,
    )
    .await?
    .finish()
    .await
}

pub fn delete_oauth_tokens_for_server(name: &str, server: &McpServerConfig) -> Result<bool> {
    if server.reviewed_plugin.is_some() {
        bail!("OAuth storage is disabled for plugin-contributed MCP servers");
    }
    let Some(url) = server.url.as_deref() else {
        bail!("OAuth logout is only supported for URL-based MCP servers");
    };
    delete_oauth_tokens(name, url)
}

fn server_has_manual_authorization(server: &McpServerConfig) -> bool {
    server.bearer_token_env_var.is_some()
        || contains_authorization_header(&server.headers)
        || contains_authorization_header(&server.env_headers)
}

pub fn build_default_headers(
    http_headers: &HashMap<String, String>,
    env_headers: &HashMap<String, String>,
) -> Result<HeaderMap> {
    let mut headers = HeaderMap::new();
    for (name, value) in http_headers {
        insert_header(&mut headers, name, value)?;
    }

View on GitHub (pinned to 0c42157ee5)

Solutions

Skip logout for stdio servers — remove static credentials (bearer_token_env_var, env vars) instead
If the server should be URL-based, fix the config by adding its url, then retry logout
Filter server lists by server.url.is_some() before offering the logout action

Defensive patterns

Strategy: validation

Validate before calling

if server.url.is_none() {
    // stdio server: clear static credentials instead of OAuth tokens
    return Ok(false);
}

Type guard

fn supports_oauth_logout(server: &McpServerConfig) -> bool {
    server.url.is_some() && server.reviewed_plugin.is_none()
}

Prevention

Gate every logout call site on server.url.is_some()
Combine the guard with the reviewed_plugin check from login/storage rules
Automate config audits: stdio entries should never reference OAuth lifecycle commands

When it happens

Trigger: Calling delete_oauth_tokens_for_server on an McpServerConfig whose url field is None (command-based stdio server).

Common situations: Scripts or UI flows that call logout for every configured server without filtering by transport; a server entry that was switched from url to command while stale OAuth tokens were expected; trying to 'clear credentials' on a local process server.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/12d75660b10d13fc. Report an issue: GitHub.