koala73/worldmonitor · error · SafeWebMcpError

open_sign_in does not accept credentials or other arguments.

Error message

open_sign_in does not accept credentials or other arguments.

What it means

The WebMCP tool open_sign_in takes no arguments — it only opens the sign-in flow; credentials are never passed through MCP for security. The handler enforces hasOnlyOwnKeys(args, []) and throws SafeWebMcpError('validation') if any key is present, explicitly calling out credentials in the message.

Solutions

1. Call open_sign_in with no arguments at all.
2. Complete authentication through the app's own sign-in UI/flow, not the MCP tool.
3. Remove any credential-injection middleware that adds keys to MCP tool arguments.

Example fix

// before
const res = await mcp.callTool('open_sign_in', { username: 'u', password: 'p' });
// after
const res = await mcp.callTool('open_sign_in', {});

if (args && Object.keys(args).length > 0) throw new Error('open_sign_in takes no arguments; never pass credentials');

const isNoArgs = (a: unknown): a is Record<never, never> =>
  a === undefined || (typeof a === 'object' && a !== null && Object.keys(a).length === 0);

try {
  const res = await mcp.callTool('open_sign_in', {});
} catch (e) {
  if (e instanceof Error && e.message.includes('does not accept credentials')) {
    console.error('Complete sign-in in the app UI; the MCP tool takes no args', e.message);
  } else throw e;
}

When it happens

Trigger: Calling open_sign_in with { username, password }, { token }, { email }, or any other key; attempting to pre-fill or automate authentication through the tool.

Common situations: Developers trying to script logins via MCP instead of the real auth flow; passing credentials because other tools in the stack accept them; automation harnesses that blanket-inject context/credentials objects into every tool call.

Understand the failure class

Background: "must be a positive integer", "cannot be empty", "invalid argument": how invalid-argument errors work across open-source libraries — this error's family across 33 libraries.

Related errors

• list_followed_countries does not accept arguments.
• ${label} HTTP 400
• Could not resolve ${JSON.stringify(echoCountryInput(raw))} t
• MCP_PRO_GRANT_HMAC_SECRET is not set
• get_intel_timeline requires at least one of domain ("conflic

AI-assisted analysis of koala73/worldmonitor@7d06c8633d (2026-09-15). Data as JSON: /api/errors/e6b43b9e82ebe14c. Report an issue: GitHub.

Appendix: source

Thrown at src/services/webmcp.ts:3101

      annotations: { readOnlyHint: true },
      execute: withBindings(WEBMCP_SPA_TOOL.getAccessContext, async (_args, extra) => (
        boundWebMcpAccessContext(await app.getAccessContext(extra), Boolean(extra?.signal))
      ), trackEvent),
    },
    {
      name: WEBMCP_SPA_TOOL.openSignIn,
      title: 'Open Sign In',
      description:
        'Open the existing Clerk sign-in dialog on this page. Does not accept credentials, one-time codes, or provider choices. Returns a stable reason when Clerk is unavailable or the dialog is already open.',
      inputSchema: {
        type: 'object',
        properties: {},
        additionalProperties: false,
      },
      annotations: { readOnlyHint: false },
      execute: withBindings(WEBMCP_SPA_TOOL.openSignIn, async (args, extra) => {
        if (!hasOnlyOwnKeys(args, [])) {
          throw new SafeWebMcpError(
            'open_sign_in does not accept credentials or other arguments.',
            'validation',
          );
        }
        return boundOpenSignInResult(await app.openSignIn(extra));
      }, trackEvent),
    },
  ];
  const registered = new Set(tools.map((tool) => tool.name));
  for (const name of WEBMCP_SPA_TOOL_NAMES) {
    if (!registered.has(name)) {
      throw new Error(`WebMCP SPA inventory is missing ${name}.`);
    }
  }
  return tools;
}

function registrationFailureReason(error: unknown): RegistrationFailureReason | 'aborted' {

View on GitHub (pinned to 7d06c8633d)