{"record":{"id":"10b33250a8197a5e","repo":"AlistGo/alist","slug":"guest-user-is-disabled","errorCode":null,"errorMessage":"guest user is disabled","messagePattern":"guest user is disabled","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/mcp/auth.go","lineNumber":59,"sourceCode":"\tif token != \"\" && subtle.ConstantTimeCompare([]byte(token), []byte(setting.GetStr(conf.Token))) == 1 {\n\t\tadmin, err := op.GetAdmin()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to get admin: %w\", err)\n\t\t}\n\t\tif err := loadRoles(admin); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\treturn admin, nil\n\t}\n\n\t// No token: guest\n\tif token == \"\" {\n\t\tguest, err := op.GetGuest()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to get guest: %w\", err)\n\t\t}\n\t\tif guest.Disabled {\n\t\t\treturn nil, fmt.Errorf(\"guest user is disabled\")\n\t\t}\n\t\tif err := loadRoles(guest); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\treturn guest, nil\n\t}\n\n\t// JWT token\n\tclaims, err := common.ParseToken(token)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid token: %w\", err)\n\t}\n\n\tuser, err := op.GetUserByName(claims.Username)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"user not found: %w\", err)\n\t}\n","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/AlistGo/alist/blob/843d9dc8149126976b2625911e45a4d3ffd6f2f5/server/mcp/auth.go#L41-L77","documentation":"Returned by authenticateToken (server/mcp/auth.go:59) when a tokenless MCP request maps to the guest user and that account has Disabled == true. This is an intentional policy decision, distinct from 1188: the guest row loaded fine, but the administrator has turned guest access off for this instance.","triggerScenarios":"MCP client connects with no Authorization header (or an empty token) to an instance where the guest user is disabled in the admin panel.","commonSituations":"Hardened deployments that disable guest by default; leftover MCP client configuration from before guest was switched off.","solutions":["Supply a valid token (admin static token or a user JWT) in the MCP client configuration","If anonymous MCP read access is desired, re-enable the guest user in the admin users panel","Document per-instance whether tokenless MCP is allowed"],"exampleFix":"// before\nclient.connect({}) // no token\n// after\nclient.connect({ headers: { Authorization: \"<admin-or-user-token>\" } })","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"u, err := mcpGuest()\nif err != nil && strings.Contains(err.Error(), \"guest user is disabled\") { u, err = mcpLogin(configuredToken) }","preventionTips":["Do not rely on guest MCP availability — configure a real token","Check the guest user's enabled state after hardening changes"],"tags":["mcp","auth","guest","configuration"],"backgroundTag":null,"analyzedSha":"843d9dc8149126976b2625911e45a4d3ffd6f2f5","analyzedAt":"2026-08-15T12:14:11.722Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}