{"record":{"id":"3c775b5dd8fcd84a","repo":"danny-avila/LibreChat","slug":"mcp-servername-toolname-upstream-authent","errorCode":null,"errorMessage":"[MCP][${serverName}][${toolName}] upstream authentication failed; MCP OAuth is not configured for this server.","messagePattern":"\\[MCP\\]\\[(.+?)\\]\\[(.+?)\\] upstream authentication failed; MCP OAuth is not configured for this server\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"api/server/services/MCP.js","lineNumber":1144,"sourceCode":"      );\n\n      /** OAuth error, provide a helpful message */\n      const isOAuthError =\n        error.message?.includes('401') ||\n        error.message?.includes('OAuth') ||\n        error.message?.includes('authentication') ||\n        error.message?.includes('Non-200 status code (401)');\n      const isOAuthFlowSignal =\n        error.message === 'OAuth flow initiated - return early' ||\n        error.message === 'Pending OAuth flow reused - return early';\n\n      if (isOAuthError) {\n        if (\n          capturedServerConfig &&\n          !requiresOAuthMachinery(capturedServerConfig) &&\n          !isOAuthFlowSignal\n        ) {\n          throw new Error(\n            `[MCP][${serverName}][${toolName}] upstream authentication failed; MCP OAuth is not configured for this server.`,\n          );\n        }\n        throw new Error(\n          `[MCP][${serverName}][${toolName}] OAuth authentication required. Please check the server logs for the authentication URL.`,\n        );\n      }\n\n      throw new Error(\n        `[MCP][${serverName}][${toolName}] tool call failed${error?.message ? `: ${error?.message}` : '.'}`,\n      );\n    }\n  };\n\n  const toolInstance = tool(_call, {\n    schema,\n    name: normalizedToolKey,\n    description: description || '',","sourceCodeStart":1126,"sourceCodeEnd":1162,"githubUrl":"https://github.com/danny-avila/LibreChat/blob/5ff282f9006c436e561de1afd39a481bea1ef0d8/api/server/services/MCP.js#L1126-L1162","documentation":"In the MCP tool _call catch block (MCP.js:1144), when the upstream error looks like an auth failure (401/OAuth/authentication substring) AND the captured server config does not require OAuth machinery, the tool refuses with this message. It tells the operator the MCP server returned 401 but LibreChat has no OAuth flow configured for that server, so the credential path is misconfigured rather than merely pending.","triggerScenarios":"An MCP server returns HTTP 401 (or a message containing 'authentication'/'OAuth') during callTool, but the server entry in librechat.yaml has no oauth config block and requiresOAuthMachinery(capturedServerConfig) is false. The user has no usable static token and no OAuth path to fall back to.","commonSituations":"MCP server added with only a url but the upstream now requires OAuth. Token fields renamed/moved in config. The server's auth header/token injection code path is broken so the upstream sees an anonymous request.","solutions":["Add an OAuth configuration block for the MCP server in librechat.yaml so requiresOAuthMachinery returns true.","If the server uses static credentials, fix the headers/token config so the 401 stops — the error is a symptom of the upstream rejecting your (absent) credentials.","Confirm the MCP server definition key matches what the tool registry expects; a mismatch can drop the oauth block."],"exampleFix":"# before\nmcpServers:\n  github:\n    url: https://mcp.github.example/sse\n# after\nmcpServers:\n  github:\n    type: sse\n    url: https://mcp.github.example/sse\n    oauth:\n      scope: github\n      client_id: ${MCP_GH_CLIENT_ID}","handlingStrategy":"try-catch","validationCode":"function assertMcpAuthConfigured(serverName, serverConfig) {\n  const needsOauth = upstreamRequiresAuth(serverConfig);\n  if (needsOauth && !requiresOAuthMachinery(serverConfig)) {\n    throw new Error(`Add an oauth block for ${serverName} in librechat.yaml`);\n  }\n}","typeGuard":"const hasOauthBlock = (cfg) => !!(cfg?.oauth || cfg?.oauthConfig);","tryCatchPattern":"try {\n  await callMcpTool(...);\n} catch (e) {\n  if (/OAuth is not configured/.test(e.message)) { await fixServerConfig(serverName); return; }\n  throw e;\n}","preventionTips":["When adding an MCP server that requires auth, include the oauth block from the start.","Smoke-test each new MCP server with a single tool call before exposing it to users."],"tags":["mcp","oauth","authentication","config"],"backgroundTag":null,"analyzedSha":"5ff282f9006c436e561de1afd39a481bea1ef0d8","analyzedAt":"2026-08-12T21:38:08.145Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}