ruvnet/ruflo · error

unauthorized

Error message

unauthorized

What it means

Auth middleware rejected the request: MCP_AUTH_TOKEN is set, the path is not /health, and the Authorization header did not carry the expected bearer token. The 401 is deliberate hardening when the bridge is exposed beyond localhost; in local-only mode (token unset) this middleware is a no-op.

Source

Thrown at ruflo/src/mcp-bridge/index.js:926

    res.setHeader("Vary", "Origin");
  }
  res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, Mcp-Session-Id");
  if (req.method === "OPTIONS") return res.sendStatus(204);
  next();
});

// ---------- Auth middleware ----------
// No-op in local-only mode (MCP_AUTH_TOKEN unset). Enforces 401 when token is set.
const MCP_TOKEN = process.env.MCP_AUTH_TOKEN || "";
function requireAuth(req, res, next) {
  if (req.path === "/health") return next();
  if (!MCP_TOKEN) return next();
  const expected = `Bearer ${MCP_TOKEN}`;
  const got = req.get("authorization") || "";
  const ok = got.length === expected.length &&
    timingSafeEqual(Buffer.from(got), Buffer.from(expected));
  if (!ok) return res.status(401).json({ error: "unauthorized" });
  next();
}
app.use(requireAuth);

// ---------- Shared MCP handler ----------
function createMcpHandler(groupName) {
  return async (req, res) => {
    const { method, id, params } = req.body;
    try {
      switch (method) {
        case "initialize":
          return res.json({
            jsonrpc: "2.0", id,
            result: {
              protocolVersion: "2024-11-05",
              capabilities: { tools: {} },
              serverInfo: { name: `mcp-bridge/${groupName}`, version: "2.0.0" },
            },

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Provide valid authentication credentials (API key or OAuth token) with the request.
2. Verify the token has not expired and that the credentials grant access to the requested resource; re-authenticate if needed.

When it happens

Trigger: Thrown at ruflo/src/mcp-bridge/index.js:926 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/a012857685fb3de5. Report an issue: GitHub.