{"record":{"id":"4db90462a5b61340","repo":"Hmbown/CodeWhale","slug":"oauth-is-disabled-for-plugin-contributed-mcp-serve","errorCode":null,"errorMessage":"OAuth is disabled for plugin-contributed MCP servers; use a reviewed environment-backed header or bearer token","messagePattern":"OAuth is disabled for plugin-contributed MCP servers; use a reviewed environment-backed header or bearer token","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/mcp/oauth.rs","lineNumber":439,"sourceCode":"    )\n    .await\n}\n\n/// Run an MCP OAuth login that can be stopped by the caller.\n///\n/// Cancellation drops the in-flight OAuth future before this function returns,\n/// which also closes its callback listener. A caller that replaces one login\n/// with another should await the cancelled call before starting the replacement.\npub async fn perform_oauth_login_for_server_with_cancel(\n    name: &str,\n    server: &McpServerConfig,\n    explicit_scopes: Option<Vec<String>>,\n    callback_port: Option<u16>,\n    callback_url: Option<&str>,\n    cancellation_token: CancellationToken,\n) -> Result<()> {\n    if server.reviewed_plugin.is_some() {\n        bail!(\n            \"OAuth is disabled for plugin-contributed MCP servers; use a reviewed environment-backed header or bearer token\"\n        );\n    }\n    run_cancellable_oauth(\n        &cancellation_token,\n        perform_oauth_login_for_server_inner(\n            name,\n            server,\n            explicit_scopes,\n            callback_port,\n            callback_url,\n        ),\n    )\n    .await\n}\n\nasync fn run_cancellable_oauth<F, T>(cancellation_token: &CancellationToken, future: F) -> Result<T>\nwhere","sourceCodeStart":421,"sourceCodeEnd":457,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/mcp/oauth.rs#L421-L457","documentation":"perform_oauth_login_for_server_with_cancel refuses to start an interactive OAuth login when the target server entry is plugin-contributed (reviewed_plugin is Some). Plugin-contributed servers run under a review model where interactive browser OAuth is out of scope; they must authenticate via reviewed environment-backed headers or bearer tokens instead, and the error says exactly that.","triggerScenarios":"Invoking the OAuth login flow (with or without cancellation token, custom scopes, or callback overrides — those parameters are irrelevant to the check) against a server whose config carries reviewed_plugin metadata.","commonSituations":"A user tries to run OAuth login for a server that was auto-registered by an installed plugin; tooling scripts that iterate all servers and attempt login uniformly.","solutions":["Configure a reviewed environment-backed Authorization header or bearer token for the plugin server instead of OAuth","If interactive OAuth is genuinely required, register the server as a regular user-level config entry (no reviewed_plugin) and log in there","Skip plugin-contributed servers when scripting OAuth login over all servers"],"exampleFix":"# before\n# server came from a plugin (reviewed_plugin set); oauth login is refused\n\n# after — register it yourself without plugin metadata, then use env-backed auth\n{\"servers\": {\"my-server\": {\"url\": \"https://example.com/mcp\", \"headers\": {\"Authorization\": \"Bearer ${MY_SERVER_TOKEN}\"}}}}","handlingStrategy":"fallback","validationCode":"if server.reviewed_plugin.is_some() {\n    anyhow::ensure!(\n        server_has_static_auth(server),\n        \"plugin server {name} cannot use OAuth; configure an env-backed header or bearer token\"\n    );\n} else {\n    perform_oauth_login_for_server_with_cancel(name, server, scopes, port, url, token).await?;\n}","typeGuard":"fn is_plugin_contributed(server: &McpServerConfig) -> bool {\n    server.reviewed_plugin.is_some()\n}","tryCatchPattern":null,"preventionTips":["Skip plugin-contributed servers when scripting OAuth login across all servers","Provide reviewed env-backed Authorization headers for plugin servers from the start","Register servers needing interactive OAuth as user-level config, not via plugins"],"tags":["mcp","oauth","plugin","policy","auth"],"backgroundTag":"oauth-disabled-by-policy","analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}