{"record":{"id":"d1db3d4744c6c5f9","repo":"screenpipe/screenpipe","slug":"error","errorCode":null,"errorMessage":"{}","messagePattern":"\\{\\}","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/screenpipe-connect/src/mcp_servers.rs","lineNumber":863,"sourceCode":" continue;\n }\n };\n let status = response.status();\n let text = response\n .text()\n .await\n .map_err(|e| anyhow!(\"failed to read OAuth metadata from {}: {}\", url, e))?;\n if status.is_success() {\n return Ok((url.clone(), text));\n }\n last_error = Some(format!(\n \"{} returned {}: {}\",\n url,\n status,\n truncate(&text, 400)\n ));\n }\n Err(anyhow!(\n \"{}\",\n last_error.unwrap_or_else(|| \"no OAuth metadata URLs to try\".to_string())\n ))\n }\n\n /// Returns `(client_id, client_secret)`. The secret is `Some` only when the\n /// server registers us as a confidential client (and then it must be\n /// presented on every token / refresh request).\n async fn register_oauth_client(\n &self,\n registration_endpoint: Option<&str>,\n redirect_uri: &str,\n ) -> Result<(String, Option)> {\n let Some(registration_endpoint) = registration_endpoint else {\n return Err(anyhow!(\n \"OAuth server does not advertise dynamic client registration\"\n ));\n };","sourceCodeStart":845,"sourceCodeEnd":881,"githubUrl":"https://github.com/screenpipe/screenpipe/blob/4ebf712990fee17eeaf904dacf749b6e96ac9bf3/crates/screenpipe-connect/src/mcp_servers.rs#L845-L881","documentation":"Terminal error of fetch_first_json: after trying every candidate metadata URL, none succeeded. The message is the last recorded failure — either ' returned : ' for HTTP errors or ': ' for transport failures, or 'no OAuth metadata URLs to try' when the list was empty.","triggerScenarios":"OAuth discovery against an MCP server where all authorization-server metadata URLs return non-2xx (404, 502, 401...) or all fail at the transport layer; also when authorization_server_metadata_urls produced no candidates.","commonSituations":"Auth server is down or behind a 5xx-ing proxy, the MCP server advertises an authorization_servers URL that 404s, network/VPN blocks the auth domain, or metadata URL construction yields an empty list.","solutions":["Read the embedded last_error in the message: it names the URL, status, and body snippet that failed last.","curl the metadata URL shown in the message to reproduce outside the app.","Verify the MCP server's /.well-known/oauth-protected-resource advertises a valid authorization_servers entry.","Check that the auth server is reachable (DNS/VPN/firewall) and not returning 5xx."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// verify discovery candidates resolve and respond before invoking the flow\nfor url in metadata_urls {\n let ok = reqwest::get(url).await.map(|r| r.status().is_success()).unwrap_or(false);\n assert!(ok, \"metadata URL unreachable: {}\", url);\n}","typeGuard":null,"tryCatchPattern":"match result {\n Err(e) if e.to_string() == \"no OAuth metadata URLs to try\" => {\n // configure authorization endpoints manually via oauth.token_url / oauth.auth_url\n configure_manual_oauth_endpoints().await\n }\n Err(e) => return Err(e),\n Ok(v) => Ok(v),\n}","preventionTips":["Ensure the MCP server's protected-resource metadata lists a reachable authorization_servers entry","Pre-configure token_url/auth_url for servers behind restrictive networks","Monitor auth-server uptime; discovery fails entirely when it's down","Test metadata URLs with curl after any provider migration"],"tags":["network","oauth","discovery"],"backgroundTag":"oauth-discovery-failed","analyzedSha":"4ebf712990fee17eeaf904dacf749b6e96ac9bf3","analyzedAt":"2026-09-01T23:33:43.065Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}