{"record":{"id":"17591007b8a8cbd5","repo":"Hmbown/CodeWhale","slug":"reviewed-plugin-mcp-authentication-failed-provide","errorCode":null,"errorMessage":"Reviewed plugin MCP authentication failed (provider details suppressed)","messagePattern":"Reviewed plugin MCP authentication failed \\(provider details suppressed\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/mcp/http.rs","lineNumber":100,"sourceCode":"        if !mcp_headers_have_authorization(&headers)\n            && let Some(env_var) = self.bearer_token_env_var.as_deref()\n            && let Ok(token) = self.reviewed_plugin.as_ref().map_or_else(\n                || std::env::var(env_var),\n                |source| source.host_environment.var(env_var),\n            )\n        {\n            let token = token.trim();\n            if !token.is_empty() {\n                headers.insert(\"Authorization\".to_string(), format!(\"Bearer {token}\"));\n            }\n        }\n        if !mcp_headers_have_authorization(&headers)\n            && let Some(oauth) = &self.oauth\n        {\n            let authorization = match oauth.authorization_header().await {\n                Ok(authorization) => authorization,\n                Err(_) if self.suppress_server_error_details => {\n                    anyhow::bail!(\n                        \"Reviewed plugin MCP authentication failed (provider details suppressed)\"\n                    )\n                }\n                Err(error) => return Err(error),\n            };\n            if let Some(value) = authorization {\n                headers.insert(\"Authorization\".to_string(), value);\n            }\n        }\n        Ok(headers)\n    }\n}\n\npub(super) fn mcp_headers_have_authorization(headers: &HashMap<String, String>) -> bool {\n    headers\n        .keys()\n        .any(|key| key.trim().eq_ignore_ascii_case(\"authorization\"))\n}","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/8880682c63083a91624de936797efa3ce9e498fd/crates/tui/src/mcp/http.rs#L82-L118","documentation":"For reviewed plugins, HTTP auth resolution suppresses provider details: if no static Authorization header was configured and oauth.authorization_header() fails, the raw provider error is replaced with this generic message so reviewed-plugin OAuth internals (URLs, client IDs, error bodies) are not leaked. The underlying cause is typically an expired or revoked refresh token, changed provider credentials, or a network failure reaching the token endpoint.","triggerScenarios":"resolved_headers() runs on a reviewed plugin MCP server with no Authorization header configured, and the stored OAuth token cannot be refreshed (expired/revoked token, unreachable token endpoint, or changed client credentials).","commonSituations":"Returning after a long absence so the refresh token expired; the provider rotated client secrets; a corporate proxy blocking the token endpoint; a corrupted token-store entry.","solutions":["Re-run the OAuth login flow for that server (reconnect or re-add triggers interactive re-auth)","Verify network access to the provider's token endpoint (proxy, firewall, DNS)","If provider credentials or scopes changed, update the server's OAuth config and re-authenticate","Confirm the secrets-store entry for the server exists and was written by the current codewhale version"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"match transport.auth.resolved_headers().await {\n    Err(e) if e.to_string().contains(\"authentication failed (provider details suppressed)\") => {\n        // trigger the interactive OAuth login flow for this server, then retry header resolution once\n    }\n    other => other,\n}","preventionTips":["Re-authenticate proactively when a reviewed-plugin server has been idle longer than its token TTL","Keep token endpoints reachable from the codewhale process (check proxy and firewall rules)","Treat the suppressed message as 're-auth needed', not as a specific provider error"],"tags":["mcp","oauth","auth","plugins","redaction"],"backgroundTag":null,"analyzedSha":"8880682c63083a91624de936797efa3ce9e498fd","analyzedAt":"2026-08-16T11:31:27.956Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}