{"record":{"id":"3015ad02f2288ac7","repo":"paperclipai/paperclip","slug":"mcp-remote-missing-secret","errorCode":"mcp_remote_missing_secret","errorMessage":"A configured credential secret could not be resolved.","messagePattern":"A configured credential secret could not be resolved\\.","errorType":"http","errorClass":"ToolGatewayHttpError","httpStatus":422,"severity":"error","filePath":"server/src/services/tool-gateway.ts","lineNumber":4051,"sourceCode":"          session,\n          connection,\n          grant,\n          grantRef,\n          // OAuth grants declare their canonical oauth.* path. Treating\n          // this header projection as a generic credentials.* binding loses\n          // the personal secret declaration created by the OAuth callback.\n          grantRef.configPath.startsWith(\"oauth.\")\n            ? grantRef.configPath\n            : `credentials.${ref.name}`,\n        );\n        headers[ref.key] = `${ref.prefix ?? \"\"}${value}`;\n      } catch {\n        await markRemoteConnectionHealth(\n          connection,\n          \"missing_secret\",\n          \"A configured credential secret could not be resolved.\",\n        );\n        throw new ToolGatewayHttpError(\n          422,\n          \"A configured credential secret could not be resolved.\",\n          \"mcp_remote_missing_secret\",\n          { connectionId: connection.id, credential: ref.name },\n        );\n      }\n    }\n    const oauthAccessRef = grant.credentialSecretRefs.find(\n      (ref) => ref.configPath === \"oauth.access_token\",\n    );\n    if (oauthAccessRef && headers.Authorization === undefined) {\n      try {\n        const value = await resolveGrantSecretValue(\n          session,\n          connection,\n          grant,\n          oauthAccessRef,\n        );","sourceCodeStart":4033,"sourceCodeEnd":4069,"githubUrl":"https://github.com/paperclipai/paperclip/blob/3f1d897a7c018d76563a21c6e39c3c9b03933622/server/src/services/tool-gateway.ts#L4033-L4069","documentation":"Credential resolution failure while building request headers for a tool connection: secrets.resolveSecretValue could not resolve one of the connection's credentialRefs (placement=header) — the secret is missing, its version is unavailable, or access was denied for this consumer. The masked 500 indicates an operator-side secret configuration problem, not caller input.","triggerScenarios":"Thrown at server/src/services/tool-gateway.ts:2397 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the connection's credential reference: the named secret is missing from the secret store. Reconfigure the credential or create the secret."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3f1d897a7c018d76563a21c6e39c3c9b03933622","analyzedAt":"2026-09-18T08:03:59.046Z","contentChangedAt":"2026-09-18T08:03:59.046Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}