{"record":{"id":"cce7bec60012c4d1","repo":"AlistGo/alist","slug":"failed-to-get-admin-w","errorCode":null,"errorMessage":"failed to get admin: %w","messagePattern":"failed to get admin: %w","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"server/mcp/auth.go","lineNumber":44,"sourceCode":"\tif token == \"\" {\n\t\ttoken = r.URL.Query().Get(\"token\")\n\t}\n\n\tuser, err := authenticateToken(token)\n\tif err != nil {\n\t\tlog.Debugf(\"MCP auth failed: %v\", err)\n\t\treturn ctx\n\t}\n\n\treturn context.WithValue(ctx, userKey, user)\n}\n\nfunc authenticateToken(token string) (*model.User, error) {\n\t// Check admin static token\n\tif token != \"\" && subtle.ConstantTimeCompare([]byte(token), []byte(setting.GetStr(conf.Token))) == 1 {\n\t\tadmin, err := op.GetAdmin()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to get admin: %w\", err)\n\t\t}\n\t\tif err := loadRoles(admin); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\treturn admin, nil\n\t}\n\n\t// No token: guest\n\tif token == \"\" {\n\t\tguest, err := op.GetGuest()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to get guest: %w\", err)\n\t\t}\n\t\tif guest.Disabled {\n\t\t\treturn nil, fmt.Errorf(\"guest user is disabled\")\n\t\t}\n\t\tif err := loadRoles(guest); err != nil {\n\t\t\treturn nil, err","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/AlistGo/alist/blob/843d9dc8149126976b2625911e45a4d3ffd6f2f5/server/mcp/auth.go#L26-L62","documentation":"Returned by authenticateToken (server/mcp/auth.go:44) when the presented token exactly matches the server's static admin token (conf.Token) but op.GetAdmin() fails. The token itself is correct — the failure is server-side, typically a database problem or a missing or underinitialized admin account, and the wrapped %w error carries the underlying cause.","triggerScenarios":"MCP client connects with the admin static token while the database is unreachable, not yet migrated, or the admin user row is missing (fresh install never initialized).","commonSituations":"Starting the MCP endpoint before completing first-time setup; database outage or locked SQLite file; restored backup missing the user table contents.","solutions":["Check server logs for the wrapped cause (connection refused, no such table, etc.)","Verify the database connection and that first-run initialization completed (admin user exists)","If using SQLite, confirm no concurrent process holds a conflicting lock","Retry once the backing store is healthy — the static token is fine"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"user, err := mcpLogin(token)\nif err != nil && strings.Contains(err.Error(), \"failed to get admin\") {\n  waitForDbHealthy()\n  user, err = mcpLogin(token) // one bounded retry\n}","preventionTips":["Complete first-run initialization before exposing MCP","Monitor DB health; MCP admin auth fails loudly when it degrades","Alert on the wrapped cause in logs, not just the top-level message"],"tags":["mcp","auth","database","server-side"],"backgroundTag":null,"analyzedSha":"843d9dc8149126976b2625911e45a4d3ffd6f2f5","analyzedAt":"2026-08-15T12:14:11.722Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}