{"record":{"id":"11a373dc94bda06a","repo":"mastra-ai/mastra","slug":"cannot-authenticate-mcp-server-servername-it-i","errorCode":null,"errorMessage":"Cannot authenticate MCP server ${serverName}: it is not configured with an MCPOAuthClientProvider.","messagePattern":"Cannot authenticate MCP server (.+?): it is not configured with an MCPOAuthClientProvider\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/mcp/src/client/configuration.ts","lineNumber":891,"sourceCode":"      if (abortController.signal.aborted) {\n        throw new Error(`Authentication for MCP server ${serverName} was cancelled.`);\n      }\n    };\n\n    // Resources acquired during setup that must be released on every exit path.\n    // Tracked here so the single outer finally can tear them down even if a\n    // fallible setup step (session begin, port binding) throws.\n    let provider: MCPOAuthClientProvider | undefined;\n    let sessionStarted = false;\n    let callbackServer: OAuthCallbackServer | undefined;\n\n    // Installed before the first fallible step so the abort-controller entry,\n    // provider session, and callback server never leak on an early throw.\n    try {\n      const config = this.getServerConfig(serverName);\n      const candidateProvider = config.authProvider;\n      if (!(candidateProvider instanceof MCPOAuthClientProvider)) {\n        throw new Error(\n          `Cannot authenticate MCP server ${serverName}: it is not configured with an MCPOAuthClientProvider.`,\n        );\n      }\n      provider = candidateProvider;\n\n      const redirectUrl = new URL(provider.redirectUrl.toString());\n      if (redirectUrl.protocol !== 'http:' || !isLoopbackHostname(redirectUrl.hostname)) {\n        throw new Error(\n          `Cannot authenticate MCP server ${serverName}: the provider's redirect URL must be a loopback address, got ${redirectUrl.origin}.`,\n        );\n      }\n\n      const state = await provider.beginAuthorizationSession();\n      sessionStarted = true;\n      // A cancel that arrived during beginAuthorizationSession() has no callback\n      // server to close yet, so bail here before binding a port and parking.\n      throwIfAborted();\n","sourceCodeStart":873,"sourceCodeEnd":909,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/mcp/src/client/configuration.ts#L873-L909","documentation":"Error thrown at the start of runAuthorizationFlow when the server's configured authProvider is not an instance of MCPOAuthClientProvider. The OAuth authorization flow (PKCE, callback server, token exchange) only works with the library's MCPOAuthClientProvider; a custom or missing provider cannot drive it.","triggerScenarios":"Calling the authenticate/flow method for a server whose config either has no authProvider or has an authProvider that is a different implementation (custom object, another OAuth library's provider).","commonSituations":"Configuring authProviders generically or passing a token-only provider; forgetting to import/construct MCPOAuthClientProvider; switching server configs and losing the provider instance.","solutions":["Set the server config's authProvider to a new MCPOAuthClientProvider(...) instance.","Verify the provider instance is created with the required options (client id/secret, redirect URL).","If using a custom provider, either extend MCPOAuthClientProvider or implement the flow manually instead of calling runAuthorizationFlow.","Confirm you are authenticating the correct serverName whose config carries the provider."],"exampleFix":"// before\n{ url: 'https://mcp.example.com/mcp', authProvider: { token: 'abc' } }\n// after\nimport { MCPOAuthClientProvider } from '@mastra/mcp';\n{\n  url: 'https://mcp.example.com/mcp',\n  authProvider: new MCPOAuthClientProvider({\n    clientId: 'my-client',\n    redirectUrl: 'http://localhost:3456/callback',\n  }),\n}","handlingStrategy":"validation","validationCode":"import { MCPOAuthClientProvider } from '@mastra/mcp';\nconst config = configuredServers[serverName];\nif (!(config?.authProvider instanceof MCPOAuthClientProvider)) {\n  throw new Error(`server ${serverName} needs an MCPOAuthClientProvider before authenticating`);\n}","typeGuard":"function hasOAuthProvider(config: MastraMCPServerDefinition): config is MastraMCPServerDefinition & { authProvider: MCPOAuthClientProvider } {\n  return config.authProvider instanceof MCPOAuthClientProvider;\n}","tryCatchPattern":null,"preventionTips":["Always construct authProvider with MCPOAuthClientProvider when using the built-in auth flow.","Centralize server config creation so providers are never omitted.","Add a startup assertion that all servers needing auth have the right provider type.","Import the provider from the same package version as the client."],"tags":["mcp","oauth","configuration","type-mismatch"],"backgroundTag":"invalid-auth-provider","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}