Reviewed plugin MCP authentication failed (provider details

Error message

Reviewed plugin MCP authentication failed (provider details suppressed)

What it means

For reviewed plugins, HTTP auth resolution suppresses provider details: if no static Authorization header was configured and oauth.authorization_header() fails, the raw provider error is replaced with this generic message so reviewed-plugin OAuth internals (URLs, client IDs, error bodies) are not leaked. The underlying cause is typically an expired or revoked refresh token, changed provider credentials, or a network failure reaching the token endpoint.

Source

Thrown at crates/tui/src/mcp/http.rs:100

        if !mcp_headers_have_authorization(&headers)
            && let Some(env_var) = self.bearer_token_env_var.as_deref()
            && let Ok(token) = self.reviewed_plugin.as_ref().map_or_else(
                || std::env::var(env_var),
                |source| source.host_environment.var(env_var),
            )
        {
            let token = token.trim();
            if !token.is_empty() {
                headers.insert("Authorization".to_string(), format!("Bearer {token}"));
            }
        }
        if !mcp_headers_have_authorization(&headers)
            && let Some(oauth) = &self.oauth
        {
            let authorization = match oauth.authorization_header().await {
                Ok(authorization) => authorization,
                Err(_) if self.suppress_server_error_details => {
                    anyhow::bail!(
                        "Reviewed plugin MCP authentication failed (provider details suppressed)"
                    )
                }
                Err(error) => return Err(error),
            };
            if let Some(value) = authorization {
                headers.insert("Authorization".to_string(), value);
            }
        }
        Ok(headers)
    }
}

pub(super) fn mcp_headers_have_authorization(headers: &HashMap<String, String>) -> bool {
    headers
        .keys()
        .any(|key| key.trim().eq_ignore_ascii_case("authorization"))
}

View on GitHub (pinned to 8880682c63)

Solutions

Re-run the OAuth login flow for that server (reconnect or re-add triggers interactive re-auth)
Verify network access to the provider's token endpoint (proxy, firewall, DNS)
If provider credentials or scopes changed, update the server's OAuth config and re-authenticate
Confirm the secrets-store entry for the server exists and was written by the current codewhale version

Defensive patterns

Strategy: retry

Try / catch

match transport.auth.resolved_headers().await {
    Err(e) if e.to_string().contains("authentication failed (provider details suppressed)") => {
        // trigger the interactive OAuth login flow for this server, then retry header resolution once
    }
    other => other,
}

Prevention

Re-authenticate proactively when a reviewed-plugin server has been idle longer than its token TTL
Keep token endpoints reachable from the codewhale process (check proxy and firewall rules)
Treat the suppressed message as 're-auth needed', not as a specific provider error

When it happens

Trigger: resolved_headers() runs on a reviewed plugin MCP server with no Authorization header configured, and the stored OAuth token cannot be refreshed (expired/revoked token, unreachable token endpoint, or changed client credentials).

Common situations: Returning after a long absence so the refresh token expired; the provider rotated client secrets; a corporate proxy blocking the token endpoint; a corrupted token-store entry.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@8880682c63 (2026-08-16). Data as JSON: /api/errors/17591007b8a8cbd5. Report an issue: GitHub.