mastra-ai/mastra · error · Error

Cannot authenticate MCP server ${serverName}: it is not conf

Error message

Cannot authenticate MCP server ${serverName}: it is not configured with an MCPOAuthClientProvider.

What it means

Error thrown at the start of runAuthorizationFlow when the server's configured authProvider is not an instance of MCPOAuthClientProvider. The OAuth authorization flow (PKCE, callback server, token exchange) only works with the library's MCPOAuthClientProvider; a custom or missing provider cannot drive it.

Source

Thrown at packages/mcp/src/client/configuration.ts:891

      if (abortController.signal.aborted) {
        throw new Error(`Authentication for MCP server ${serverName} was cancelled.`);
      }
    };

    // Resources acquired during setup that must be released on every exit path.
    // Tracked here so the single outer finally can tear them down even if a
    // fallible setup step (session begin, port binding) throws.
    let provider: MCPOAuthClientProvider | undefined;
    let sessionStarted = false;
    let callbackServer: OAuthCallbackServer | undefined;

    // Installed before the first fallible step so the abort-controller entry,
    // provider session, and callback server never leak on an early throw.
    try {
      const config = this.getServerConfig(serverName);
      const candidateProvider = config.authProvider;
      if (!(candidateProvider instanceof MCPOAuthClientProvider)) {
        throw new Error(
          `Cannot authenticate MCP server ${serverName}: it is not configured with an MCPOAuthClientProvider.`,
        );
      }
      provider = candidateProvider;

      const redirectUrl = new URL(provider.redirectUrl.toString());
      if (redirectUrl.protocol !== 'http:' || !isLoopbackHostname(redirectUrl.hostname)) {
        throw new Error(
          `Cannot authenticate MCP server ${serverName}: the provider's redirect URL must be a loopback address, got ${redirectUrl.origin}.`,
        );
      }

      const state = await provider.beginAuthorizationSession();
      sessionStarted = true;
      // A cancel that arrived during beginAuthorizationSession() has no callback
      // server to close yet, so bail here before binding a port and parking.
      throwIfAborted();

View on GitHub (pinned to 75dd419e61)

Solutions

1. Set the server config's authProvider to a new MCPOAuthClientProvider(...) instance.
2. Verify the provider instance is created with the required options (client id/secret, redirect URL).
3. If using a custom provider, either extend MCPOAuthClientProvider or implement the flow manually instead of calling runAuthorizationFlow.
4. Confirm you are authenticating the correct serverName whose config carries the provider.

Example fix

// before
{ url: 'https://mcp.example.com/mcp', authProvider: { token: 'abc' } }
// after
import { MCPOAuthClientProvider } from '@mastra/mcp';
{
  url: 'https://mcp.example.com/mcp',
  authProvider: new MCPOAuthClientProvider({
    clientId: 'my-client',
    redirectUrl: 'http://localhost:3456/callback',
  }),
}

import { MCPOAuthClientProvider } from '@mastra/mcp';
const config = configuredServers[serverName];
if (!(config?.authProvider instanceof MCPOAuthClientProvider)) {
  throw new Error(`server ${serverName} needs an MCPOAuthClientProvider before authenticating`);
}

function hasOAuthProvider(config: MastraMCPServerDefinition): config is MastraMCPServerDefinition & { authProvider: MCPOAuthClientProvider } {
  return config.authProvider instanceof MCPOAuthClientProvider;
}

When it happens

Trigger: Calling the authenticate/flow method for a server whose config either has no authProvider or has an authProvider that is a different implementation (custom object, another OAuth library's provider).

Common situations: Configuring authProviders generically or passing a token-only provider; forgetting to import/construct MCPOAuthClientProvider; switching server configs and losing the provider instance.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Cannot authenticate MCP server ${serverName}: the provider's
• Redirect URI is required for SSO login
• Google client ID is required. Provide it in the options or s
• Redirect URI is required for Google SSO. Set GOOGLE_REDIRECT
• No Slack installation found for agent "${agentId}"

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/11a373dc94bda06a. Report an issue: GitHub.