OAuth storage is disabled for plugin-contributed MCP servers

Error message

OAuth storage is disabled for plugin-contributed MCP servers

What it means

delete_oauth_tokens_for_server refuses to operate when server.reviewed_plugin is Some (oauth.rs:558). OAuth tokens for plugin-contributed MCP servers are deliberately never persisted in user token storage, so there is nothing to delete, and the guard also prevents a plugin-defined server name from touching the user's OAuth storage keys.

Source

Thrown at crates/tui/src/mcp/oauth.rs:558

    OauthLoginFlow::new(
        server_name,
        server_url,
        http_headers,
        env_headers,
        scopes,
        oauth_client_id,
        oauth_resource,
        callback_port,
        callback_url,
    )
    .await?
    .finish()
    .await
}

pub fn delete_oauth_tokens_for_server(name: &str, server: &McpServerConfig) -> Result<bool> {
    if server.reviewed_plugin.is_some() {
        bail!("OAuth storage is disabled for plugin-contributed MCP servers");
    }
    let Some(url) = server.url.as_deref() else {
        bail!("OAuth logout is only supported for URL-based MCP servers");
    };
    delete_oauth_tokens(name, url)
}

fn server_has_manual_authorization(server: &McpServerConfig) -> bool {
    server.bearer_token_env_var.is_some()
        || contains_authorization_header(&server.headers)
        || contains_authorization_header(&server.env_headers)
}

pub fn build_default_headers(
    http_headers: &HashMap<String, String>,
    env_headers: &HashMap<String, String>,
) -> Result<HeaderMap> {
    let mut headers = HeaderMap::new();

View on GitHub (pinned to 0c42157ee5)

Solutions

Accept that no user-side tokens exist — the plugin manages its server's credentials itself
To fully reset a plugin-contributed server, disable or uninstall the contributing plugin and re-enable it
If the server must use user-managed OAuth, define your own server entry with the same url instead of relying on the plugin's

Defensive patterns

Strategy: validation

Validate before calling

if server.reviewed_plugin.is_some() {
    // plugin-managed server: no user-side OAuth tokens exist; nothing to delete
    return Ok(false);
}

Type guard

fn is_plugin_contributed(server: &McpServerConfig) -> bool {
    server.reviewed_plugin.is_some()
}

Prevention

Hide logout/delete-token actions for plugin-contributed servers
Audit credential ownership per server at install time: user config vs plugin
For user-managed OAuth on the same endpoint, define your own server entry with the url

When it happens

Trigger: Invoking MCP logout / token deletion on a server entry whose reviewed_plugin field is populated, i.e. one that was installed and reviewed as part of a plugin rather than user config.

Common situations: A plugin installed an MCP server and the user tries /mcp logout on it expecting stored tokens; cleanup scripts iterating all configured servers and calling delete_oauth_tokens_for_server on each; auditing where credentials live for plugin servers.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/bbc30444326be713. Report an issue: GitHub.