Kuberwastaken/claurst · error · anyhow::Error

Failed to generate PKCE verifier

Error message

Failed to generate PKCE verifier: {}

What it means

Thrown in begin_mcp_auth when the local PKCE code-verifier generator (pkce_verifier) fails. The verifier is a cryptographically random string required for the OAuth 2.0 PKCE flow against the MCP server's authorization endpoint. Failure means the random source or encoding step errored, so the auth session cannot proceed.

Solutions

1. Check the inner error ({} placeholder) for the underlying RNG/encoding cause and fix the environment accordingly
2. Verify the container/sandbox allows the getrandom syscall or has /dev/urandom available
3. Retry the auth flow — RNG failures are often transient
4. If persistent, upgrade the runtime image or the rand/getrandom dependency

Example fix

# Sandbox blocking getrandom
docker run --security-opt seccomp=unconfined ...
# or ensure /dev/urandom exists:
ls -l /dev/urandom

match pkce_verifier() {
    Ok(v) => v,
    Err(e) => { eprintln!("PKCE generation failed: {e}; check entropy source"); return; }
}

When it happens

Trigger: Calling run_mcp_auth_flow / begin_mcp_auth when pkce_verifier() returns Err — e.g. the OS entropy source (/dev/urandom, getrandom) is unavailable or the base64url encoding of the random bytes fails.

Common situations: Running in a heavily sandboxed container that blocks access to the system RNG; restricted seccomp profiles blocking the getrandom syscall; embedded/minimal Linux images without a configured entropy source.

Related errors

• models endpoint returned
• Invalid JWT: expected at least 2 dot-separated segments
• Invalid : contains unsafe characters
• Bridge register: auth error
• Bridge register: server returned

AI-assisted analysis of Kuberwastaken/claurst@b0637c97ec (2026-09-10). Data as JSON: /api/errors/27aa0dd39d9ca5b4. Report an issue: GitHub.

Appendix: source

Thrown at src-rust/crates/mcp/src/oauth.rs:198

                    .get("token_endpoint")
                    .and_then(|value| value.as_str())
                    .unwrap_or(fallback.token_endpoint.as_str())
                    .to_string(),
            })
        }
        Ok(_) | Err(_) => Ok(fallback),
    }
}

pub async fn begin_mcp_auth(
    server_name: &str,
    server_url: &str,
) -> anyhow::Result<McpAuthSession> {
    let metadata = fetch_oauth_metadata(server_url).await?;
    let redirect_port = oauth_port_alloc()
        .map_err(|e| anyhow::anyhow!("Failed to allocate OAuth redirect port: {}", e))?;
    let redirect_uri = format!("http://127.0.0.1:{}/callback", redirect_port);
    let verifier = pkce_verifier().map_err(|e| anyhow::anyhow!("Failed to generate PKCE verifier: {}", e))?;
    let auth_url = build_mcp_auth_url(
        &metadata.authorization_endpoint,
        &redirect_uri,
        &verifier,
    );

    Ok(McpAuthSession {
        server_name: server_name.to_string(),
        auth_url,
        redirect_uri,
        verifier,
        metadata,
    })
}

async fn bind_callback_listener(
    redirect_uri: &str,
) -> anyhow::Result<(TcpListener, String, String)> {

View on GitHub (pinned to b0637c97ec)