different-ai/openwork · error
OpenWork-managed OAuth requires a remote MCP URL.
Error message
OpenWork-managed OAuth requires a remote MCP URL.
What it means
Within the managedOAuth path (after the runtime check), the entry must be of type 'remote' and carry a URL, because managed OAuth is performed against a remote MCP endpoint. If entryType is not 'remote' or entry.url is missing, the store throws 'OpenWork-managed OAuth requires a remote MCP URL.'
Source
Thrown at apps/app/src/react-app/domains/connections/store.ts:802
orgSelected: Boolean(context.orgId.trim()),
connecting: false,
health: result.health,
});
setStateField("mcpStatus", `${summary.stageLabel}. ${summary.recommendedAction}`);
finishPerf(options.developerMode(), "mcp.connect", "error", startedAt, {
name: entry.name,
type: entryType,
error: summary.stageLabel,
});
return { ok: false, error: `${summary.stageLabel}. ${summary.recommendedAction}` };
}
if (entry.managedOAuth) {
if (isRemoteWorkspace || !isDesktopRuntime()) {
throw new Error("OpenWork-managed MCP OAuth is currently available for local desktop workspaces only.");
}
if (entryType !== "remote" || !entry.url) {
throw new Error("OpenWork-managed OAuth requires a remote MCP URL.");
}
if (!canUseOpenworkServer || !openworkClient || !openworkWorkspaceId) {
throw new Error("The local OpenWork server is required for managed MCP sign-in.");
}
const result = await openworkClient.addManagedMcp(openworkWorkspaceId, {
name: slug,
url: entry.url,
oauth: {
applicationType: "native",
requestedScopes: entry.oauthConfig?.scope?.split(/\s+/).filter(Boolean),
clientId: entry.oauthConfig?.clientId,
clientSecret: entry.oauthConfig?.clientSecret,
},
});
const connected = await waitForManagedMcpAuthorization(
openworkClient,
openworkWorkspaceId,
slug,View on GitHub (pinned to 2b7df46e8a)
Solutions
- Set entryType to 'remote' and provide a valid entry.url for the managed OAuth entry
- Remove the managedOAuth flag from local/stdio entries that cannot support it
- Re-add/re-sync the MCP entry so the URL metadata is restored
- Validate the entry shape before passing it to the connect action
Example fix
// before
{ "name": "acme", "type": "stdio", "managedOAuth": true }
// after
{ "name": "acme", "type": "remote", "url": "https://mcp.acme.com/sse", "managedOAuth": true } Defensive patterns
Strategy: validation
Validate before calling
if (entry.managedOAuth && (entry.type !== "remote" || !entry.url)) {
showValidationMessage("Managed OAuth entries must be remote with a URL.");
return;
} Type guard
function isManagedRemoteEntry(e: McpEntry): e is McpEntry & { type: "remote"; url: string } {
return e.managedOAuth === true && e.type === "remote" && typeof e.url === "string" && e.url.length > 0;
} Prevention
- Validate managed OAuth entries (remote type + URL) on config load
- Never set managedOAuth on stdio/local MCP entries
- Re-sync or re-add entries whose url field is missing after a failed sync
- Schema-validate persisted MCP config with Zod before handing entries to the store
When it happens
Trigger: Calling connect on a managedOAuth entry whose entryType is 'local'/'stdio' (no remote endpoint) or whose url field is empty/missing in the persisted config.
Common situations: A config entry created as a stdio/local MCP server incorrectly flagged managedOAuth; a partially synced entry where the URL field was dropped; hand-edited MCP config missing the url key.
Related errors
- protocol "${url.protocol}" is not allowed
- invalid_mcp_url
- `${t("providers.no_oauth_prefix")} ${resolved}. ${t("provide
- `${t("providers.not_oauth_flow_prefix")} ${resolved}.`
- t("providers.oauth_method_required")
AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01).
Data as JSON: /api/errors/8db10b5b39800864.
Report an issue: GitHub.