tinyhumansai/openhuman · error

--auth-token must not be empty

Error message

--auth-token must not be empty

What it means

The `--auth-token` flag (used with `openhuman mcp --transport http`) is trimmed and must be non-empty; an empty or whitespace-only value is rejected at parse time so the HTTP server never starts up with a degenerate bearer. This guards the common shell failure where an unset variable expands to an empty string.

Source

Thrown at src/openhuman/mcp/server/stdio.rs:67

                    .ok_or_else(|| anyhow::anyhow!("missing value for --host"))?
                    .clone();
                index += 2;
            }
            "--port" => {
                let raw = args
                    .get(index + 1)
                    .ok_or_else(|| anyhow::anyhow!("missing value for --port"))?;
                port = raw
                    .parse()
                    .map_err(|_| anyhow::anyhow!("invalid --port value `{raw}`"))?;
                index += 2;
            }
            "--auth-token" => {
                let token = args
                    .get(index + 1)
                    .ok_or_else(|| anyhow::anyhow!("missing value for --auth-token"))?;
                if token.trim().is_empty() {
                    bail!("--auth-token must not be empty");
                }
                auth_token = Some(token.trim().to_string());
                index += 2;
            }
            "-h" | "--help" => {
                print_help();
                return Ok(());
            }
            other => bail!("unknown mcp arg: {other}"),
        }
    }

    init_mcp_logging(verbose);

    let rt = tokio::runtime::Builder::new_multi_thread()
        .enable_all()
        .build()?;

View on GitHub (pinned to 7491200858)

Solutions

1. Provide a real token value (generate one if you operate your own security boundary).
2. Fail fast in scripts: `: "${MCP_TOKEN:?MCP_TOKEN not set}"` produces a clear message before the binary runs.
3. Check CI secret injection and shell quoting.

Example fix

# before
$ openhuman mcp --transport http --auth-token "$MCP_TOKEN"   # MCP_TOKEN unset -> expands to ''
error: --auth-token must not be empty

# after
: "${MCP_TOKEN:?MCP_TOKEN not set}"
openhuman mcp --transport http --auth-token "$MCP_TOKEN"

: "${MCP_TOKEN:?MCP_TOKEN not set}" # bash: fail fast before the binary sees ''

When it happens

Trigger: Shell expansion of an unset or empty variable — `--auth-token "$MCP_TOKEN"` with MCP_TOKEN empty — or an explicitly empty `--auth-token ''`. Typical in CI where the secret was never injected into the job.

Common situations: CI job missing the secret env var; wrapper scripts quoting an undefined variable into an empty string; .env file not sourced before the command.

Related errors

• unknown --transport value `{other}` (expected stdio or http)
• unknown mcp arg: {other}
• mcp feature disabled at compile time: this build was compile
• Socket not connected
• Invalid ${paramName}: ${value}. Must be a positive integer.

AI-assisted analysis of tinyhumansai/openhuman@7491200858 (2026-08-17). Data as JSON: /api/errors/c0c08f7b4abe79b8. Report an issue: GitHub.