MCP OAuth failed to start

[matthisholleville]

What happened?

I’m not exactly sure what’s happening, but I have the impression that Librechat does not start if I specify an MCP server with OAuth configured from an environment variable.

Version Information

a6fd32a15aa1e7c511858c215fa31af9dedfdfc1

Steps to Reproduce

1. Use this MCP configuration

...
mcpServers:
      mcp:
        type: streamable-http
        url: http://mcp.mcp.svc.cluster.local/mcp
        timeout: 60000
        headers:
          X-User-ID: "{{LIBRECHAT_USER_ID}}"
          X-User-Email: "{{LIBRECHAT_USER_EMAIL}}"
          X-User-Role: "{{LIBRECHAT_USER_ROLE}}"
          X-MCP-AUTH: "${MCP_AUTH_VALUE}"
        oauth:
          clientId: "${MCP_OAUTH_CLIENT_ID}"
          clientSecret: "${MCP_OAUTH_CLIENT_SECRET}"
          authorization_url: "https://okta.com/oauth2/v1/authorize"
          token_url: "https://okta.com/oauth2/v1/token"
          redirect_uri: "http://mcp.mcp.svc.cluster.local/oauth/callback"
          scopes: "openid profile email"
        startup: false
...

What browsers are you seeing the problem on?

Chrome

Relevant log output

{"level":"error","message":"Error in startup config MCPManager has not been initialized.","stack":"Error: MCPManager has not been initialized.\n    at getInstance (/app/packages/api/dist/index.js:7814:19)\n    at /app/api/server/routes/config.js:114:26\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)","timestamp":"2025-08-19T17:00:31.073Z"}

Screenshots

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[danny-avila]

Try adding requiresOAuth: true :

...
mcpServers:
      mcp:
        type: streamable-http
        url: http://mcp.mcp.svc.cluster.local/mcp
        timeout: 60000
        headers:
          X-User-ID: "{{LIBRECHAT_USER_ID}}"
          X-User-Email: "{{LIBRECHAT_USER_EMAIL}}"
          X-User-Role: "{{LIBRECHAT_USER_ROLE}}"
          X-MCP-AUTH: "${MCP_AUTH_VALUE}"
        # add this:
        requiresOAuth: true
        oauth:
          clientId: "${MCP_OAUTH_CLIENT_ID}"
          clientSecret: "${MCP_OAUTH_CLIENT_SECRET}"
          authorization_url: "https://okta.com/oauth2/v1/authorize"
          token_url: "https://okta.com/oauth2/v1/token"
          redirect_uri: "http://mcp.mcp.svc.cluster.local/oauth/callback"
          scopes: "openid profile email"
...

[danny-avila]

try updating, we fixed this already

[danny-avila]

requiresOAuth should also not be under oauth:

example

   mcpServers:
      sre:
        type: streamable-http
        url: http://mcp.svc.cluster.local/mcp
        timeout: 60000
        headers:
          X-User-ID: "{{LIBRECHAT_USER_ID}}"
          X-User-Email: "{{LIBRECHAT_USER_EMAIL}}"
          X-User-Role: "{{LIBRECHAT_USER_ROLE}}"
          X-SRE-KIT-MCP-AUTH: "${MCP_AUTH_VALUE}"
# Added here
        requiresOAuth: true 
        oauth:
          clientId: "${MCP_OAUTH_CLIENT_ID}"
          clientSecret: "${MCP_OAUTH_CLIENT_SECRET}"
          authorization_url: "https://okta.com/oauth2/v1/authorize"
          token_url: "https://okta.com/oauth2/v1/token"
          redirect_uri: "http://localhost:3080/oauth/callback"
          scopes: "openid profile email"
          # requiresOAuth: true # wrong
        # startup: false # not needed

[danny-avila]

I see in my earlier comment, I did not correctly indent, sorry about that, was on mobile

[danny-avila]

@matthisholleville If you're still having trouble after that, and need further help with your setup, I will need to test with your actual MCP server if you're at liberty to share.

[matthisholleville]

@danny-avila It works better, thank you.

However, there is another problem: my tools use this format "kubernetes:list_pods" and it seems this is not allowed.

I get the following error:

Something went wrong. Here's the specific error message we encountered: An error occurred while processing the request: 400 Invalid 'tools[0].function.name': string does not match pattern. Expected a string that matches the pattern '^[a-zA-Z0-9_-]+$'.