different-ai/openwork · error

OpenWork-managed OAuth requires a remote MCP URL.

Error message

OpenWork-managed OAuth requires a remote MCP URL.

What it means

Within the managedOAuth path (after the runtime check), the entry must be of type 'remote' and carry a URL, because managed OAuth is performed against a remote MCP endpoint. If entryType is not 'remote' or entry.url is missing, the store throws 'OpenWork-managed OAuth requires a remote MCP URL.'

Source

Thrown at apps/app/src/react-app/domains/connections/store.ts:802

          orgSelected: Boolean(context.orgId.trim()),
          connecting: false,
          health: result.health,
        });
        setStateField("mcpStatus", `${summary.stageLabel}. ${summary.recommendedAction}`);
        finishPerf(options.developerMode(), "mcp.connect", "error", startedAt, {
          name: entry.name,
          type: entryType,
          error: summary.stageLabel,
        });
        return { ok: false, error: `${summary.stageLabel}. ${summary.recommendedAction}` };
      }

      if (entry.managedOAuth) {
        if (isRemoteWorkspace || !isDesktopRuntime()) {
          throw new Error("OpenWork-managed MCP OAuth is currently available for local desktop workspaces only.");
        }
        if (entryType !== "remote" || !entry.url) {
          throw new Error("OpenWork-managed OAuth requires a remote MCP URL.");
        }
        if (!canUseOpenworkServer || !openworkClient || !openworkWorkspaceId) {
          throw new Error("The local OpenWork server is required for managed MCP sign-in.");
        }
        const result = await openworkClient.addManagedMcp(openworkWorkspaceId, {
          name: slug,
          url: entry.url,
          oauth: {
            applicationType: "native",
            requestedScopes: entry.oauthConfig?.scope?.split(/\s+/).filter(Boolean),
            clientId: entry.oauthConfig?.clientId,
            clientSecret: entry.oauthConfig?.clientSecret,
          },
        });
        const connected = await waitForManagedMcpAuthorization(
          openworkClient,
          openworkWorkspaceId,
          slug,

View on GitHub (pinned to 2b7df46e8a)

Solutions

  1. Set entryType to 'remote' and provide a valid entry.url for the managed OAuth entry
  2. Remove the managedOAuth flag from local/stdio entries that cannot support it
  3. Re-add/re-sync the MCP entry so the URL metadata is restored
  4. Validate the entry shape before passing it to the connect action

Example fix

// before
{ "name": "acme", "type": "stdio", "managedOAuth": true }
// after
{ "name": "acme", "type": "remote", "url": "https://mcp.acme.com/sse", "managedOAuth": true }
Defensive patterns

Strategy: validation

Validate before calling

if (entry.managedOAuth && (entry.type !== "remote" || !entry.url)) {
  showValidationMessage("Managed OAuth entries must be remote with a URL.");
  return;
}

Type guard

function isManagedRemoteEntry(e: McpEntry): e is McpEntry & { type: "remote"; url: string } {
  return e.managedOAuth === true && e.type === "remote" && typeof e.url === "string" && e.url.length > 0;
}

Prevention

When it happens

Trigger: Calling connect on a managedOAuth entry whose entryType is 'local'/'stdio' (no remote endpoint) or whose url field is empty/missing in the persisted config.

Common situations: A config entry created as a stdio/local MCP server incorrectly flagged managedOAuth; a partially synced entry where the URL field was dropped; hand-edited MCP config missing the url key.

Related errors


AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/8db10b5b39800864. Report an issue: GitHub.