{"record":{"id":"a7a5a16bcf306b36","repo":"charmbracelet/crush","slug":"mcp-s-does-not-use-oauth-authentication","errorCode":null,"errorMessage":"mcp '%s' does not use OAuth authentication","messagePattern":"mcp '(.+?)' does not use OAuth authentication","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/agent/tools/mcp/init.go","lineNumber":365,"sourceCode":"\t\tslog.Debug(\"Skipping disabled MCP\", \"name\", name)\n\t\treturn nil\n\t}\n\n\treturn initClient(ctx, cfg, name, m, currentGen(name), cfg.Resolver())\n}\n\n// AuthenticateMCP initiates the OAuth flow for an MCP server that is in\n// StateNeedsAuth. It creates the OAuth handler (which starts a local\n// callback server), connects to the server (which triggers the browser\n// auth flow on 401), and transitions to StateConnected on success.\nfunc AuthenticateMCP(ctx context.Context, cfg *config.ConfigStore, name string) error {\n\tm, exists := cfg.Config().MCP[name]\n\tif !exists {\n\t\treturn fmt.Errorf(\"mcp '%s' not found in configuration\", name)\n\t}\n\n\tif !m.OAuth || m.Type != config.MCPHttp {\n\t\treturn fmt.Errorf(\"mcp '%s' does not use OAuth authentication\", name)\n\t}\n\n\tupdateState(name, StateStarting, nil, nil, Counts{}, withPending(m))\n\n\t// This is the user-initiated flow, so permit the interactive browser\n\t// authorization the handler otherwise withholds during startup.\n\tctx = mcpoauth.WithInteractive(ctx)\n\n\t// The OAuth handler persists the token automatically as it is\n\t// exchanged, so a successful connection has already saved it.\n\t_, err := connectAndRegister(ctx, cfg, name, m, currentGen(name), cfg.Resolver(), channelEnabled(cfg.Overrides().EnabledChannels, name))\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn nil\n}\n\n// PendingAuthServer describes an MCP server awaiting OAuth.","sourceCodeStart":347,"sourceCodeEnd":383,"githubUrl":"https://github.com/charmbracelet/crush/blob/7944b8e52225d8805e31eacbf7ef24856b0dfb7a/internal/agent/tools/mcp/init.go#L347-L383","documentation":"AuthenticateMCP only supports MCP servers of type HTTP that have OAuth enabled. If the configured server lacks m.OAuth or is not config.MCPHttp, the function returns this error without starting the browser auth flow.","triggerScenarios":"Calling AuthenticateMCP on an MCP server defined as stdio/sse type, or an HTTP server configured without the OAuth flag set to true in its mcp entry.","commonSituations":"Trying to run browser OAuth for a local stdio MCP server; forgetting to set the oauth option on an HTTP server; using authenticate on a server that uses static API-key headers instead.","solutions":["Set the OAuth option on the HTTP MCP server entry in config.","Switch the server definition to type http if OAuth is intended.","For stdio/API-key servers, provide credentials via env/config instead of OAuth.","Use the correct command for non-OAuth servers instead of MCPAuthenticate."],"exampleFix":"// before\nmcp github {\n\ttype http\n\turl \"https://api.github.com/mcp\"\n}\n// after\nmcp github {\n\ttype http\n\turl \"https://api.github.com/mcp\"\n\toauth true\n}","handlingStrategy":"validation","validationCode":"srv, ok := cfg.Config().MCP[name]\nif !ok || !srv.OAuth || srv.Type != config.MCPHttp {\n\treturn fmt.Errorf(\"server %q must be an HTTP MCP server with OAuth enabled\", name)\n}","typeGuard":null,"tryCatchPattern":"if err := mcp.AuthenticateMCP(ctx, cfg, name); err != nil {\n\tif strings.Contains(err.Error(), \"does not use OAuth\") {\n\t\t// fall back to env-var/API-key credentials for this server\n\t}\n\treturn err\n}","preventionTips":["Set oauth true on HTTP MCP server entries that need browser auth.","Use env/config credentials for stdio and API-key servers instead of OAuth.","Document each MCP server's auth mechanism next to its config entry.","Validate server type before invoking OAuth flows."],"tags":["mcp","oauth","configuration","go"],"backgroundTag":"mcp-oauth-not-enabled","analyzedSha":"7944b8e52225d8805e31eacbf7ef24856b0dfb7a","analyzedAt":"2026-08-29T12:48:59.079Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}