{"record":{"id":"c0c08f7b4abe79b8","repo":"tinyhumansai/openhuman","slug":"auth-token-must-not-be-empty","errorCode":null,"errorMessage":"--auth-token must not be empty","messagePattern":"--auth-token must not be empty","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/openhuman/mcp/server/stdio.rs","lineNumber":67,"sourceCode":"                    .ok_or_else(|| anyhow::anyhow!(\"missing value for --host\"))?\n                    .clone();\n                index += 2;\n            }\n            \"--port\" => {\n                let raw = args\n                    .get(index + 1)\n                    .ok_or_else(|| anyhow::anyhow!(\"missing value for --port\"))?;\n                port = raw\n                    .parse()\n                    .map_err(|_| anyhow::anyhow!(\"invalid --port value `{raw}`\"))?;\n                index += 2;\n            }\n            \"--auth-token\" => {\n                let token = args\n                    .get(index + 1)\n                    .ok_or_else(|| anyhow::anyhow!(\"missing value for --auth-token\"))?;\n                if token.trim().is_empty() {\n                    bail!(\"--auth-token must not be empty\");\n                }\n                auth_token = Some(token.trim().to_string());\n                index += 2;\n            }\n            \"-h\" | \"--help\" => {\n                print_help();\n                return Ok(());\n            }\n            other => bail!(\"unknown mcp arg: {other}\"),\n        }\n    }\n\n    init_mcp_logging(verbose);\n\n    let rt = tokio::runtime::Builder::new_multi_thread()\n        .enable_all()\n        .build()?;\n","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/tinyhumansai/openhuman/blob/749120085864ce16e0f273c7b86fac7740b39c5b/src/openhuman/mcp/server/stdio.rs#L49-L85","documentation":"The `--auth-token` flag (used with `openhuman mcp --transport http`) is trimmed and must be non-empty; an empty or whitespace-only value is rejected at parse time so the HTTP server never starts up with a degenerate bearer. This guards the common shell failure where an unset variable expands to an empty string.","triggerScenarios":"Shell expansion of an unset or empty variable — `--auth-token \"$MCP_TOKEN\"` with MCP_TOKEN empty — or an explicitly empty `--auth-token ''`. Typical in CI where the secret was never injected into the job.","commonSituations":"CI job missing the secret env var; wrapper scripts quoting an undefined variable into an empty string; .env file not sourced before the command.","solutions":["Provide a real token value (generate one if you operate your own security boundary).","Fail fast in scripts: `: \"${MCP_TOKEN:?MCP_TOKEN not set}\"` produces a clear message before the binary runs.","Check CI secret injection and shell quoting."],"exampleFix":"# before\n$ openhuman mcp --transport http --auth-token \"$MCP_TOKEN\"   # MCP_TOKEN unset -> expands to ''\nerror: --auth-token must not be empty\n\n# after\n: \"${MCP_TOKEN:?MCP_TOKEN not set}\"\nopenhuman mcp --transport http --auth-token \"$MCP_TOKEN\"","handlingStrategy":"validation","validationCode":": \"${MCP_TOKEN:?MCP_TOKEN not set}\" # bash: fail fast before the binary sees ''","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use fail-fast env guards in every wrapper script that passes secrets.","Check CI secret injection (var name, environment scope) before deploy.","Review quoting: \"$VAR\" of an unset variable is '', which is exactly what this guard rejects."],"tags":["mcp","cli","auth-token","argument-validation"],"backgroundTag":"empty-required-parameter","analyzedSha":"749120085864ce16e0f273c7b86fac7740b39c5b","analyzedAt":"2026-08-17T21:21:45.363Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}