MCP OAuth Authentication - HTTP 401 invalid_token Error with Streamable-HTTP Transport

[gixio]

What happened?

After updating to the latest LibreChat version that includes commit 51f2d43, MCP servers using streamable-http transport with OAuth authentication are failing with HTTP 401 "invalid_token" errors. The OAuth token storage/retrieval mechanism appears to be broken, preventing successful authentication even when OAuth flow is completed. - Reverting back to before this commit allows it to work again.

Version Information

ghcr.io/danny-avila/librechat-dev-api latest 33b56b43d848 2 hours ago 1.27GB
ghcr.io/danny-avila/librechat-rag-api-dev-lite latest d813432c9b0a 2 weeks ago 1.68GB

Steps to Reproduce

1. Configure an MCP server with OAuth in librechat.yaml: (Using Taylor Wildon's Workspace MCP) https://github.com/taylorwilsdon/google_workspace_mcp - Below is my previously working MCP config.

Google-Workspace:
type: streamable-http
url: "https://gws.com/mcp"
timeout: 60000
requiresOAuth: true
oauth:
token_exchange_method: "default_post"
startup: false

2. Start/restart LibreChat with the configuration
3. Navigate to the MCP Settings Panel in LibreChat UI
4. Attempt to connect to the OAuth-enabled MCP server (Failed)

What browsers are you seeing the problem on?

No response

Relevant log output

{
  "level": "error",
  "message": "[MCP][User: 6809a0d05c439320acaa9969][Google-Workspace] Connection failed: Error POSTing to endpoint (HTTP 401): {\"error\": \"invalid_token\", \"error_description\": \"Authentication required\"}",
  "stack": "Error: Error POSTing to endpoint (HTTP 401): {\"error\": \"invalid_token\", \"error_description\": \"Authentication required\"}\n    at StreamableHTTPClientTransport.send (/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/client/streamableHttp.js:288:23)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)",
  "timestamp": "2025-09-12T01:15:08.636Z"
}

Screenshots

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[danny-avila]

Reverting back to before this commit allows it to work again.

This MCP server behaves the same for me before and after the commit. Without any walkthrough on setting this up, I can't properly test this and troubleshoot. Seems to be different here than the repo you linked suggests.

[gixio]

hmm, let me dig around more, I am using https://github.com/taylorwilsdon/google_workspace_mcp - on the config I just change the URL to temporary URL.

I will report back with more details or solution if I find one. Thanks!

[danny-avila]

Thanks! I am still poking around the repo and see if I can reproduce it

[danny-avila]

This should fix it: #9589

Looks like cleaning up OAuth flow at connection change is a bit too strict as implemented in 51f2d43 and won't work for all MCP servers.

[danny-avila]

[gixio]

Works! Thank you!

[madrover]

I'm trying to make this MCP work but I'm struggling.

Here's my current setup:

• on the docker-compose.override.yml

  mcp-google-workspace:
    # https://github.com/taylorwilsdon/google_workspace_mcp
    image: workspace-mcp:latest
    container_name: mcp-google-workspace
    environment:
      GOOGLE_OAUTH_CLIENT_ID: "${GOOGLE_OAUTH_CLIENT_ID}"
      GOOGLE_OAUTH_CLIENT_SECRET: "${GOOGLE_OAUTH_CLIENT_SECRET}"
      MCP_ENABLE_OAUTH21: "true"
      WORKSPACE_MCP_STATELESS_MODE: "true"
      OAUTH2_ENABLE_DEBUG: "true"          # optional
      OAUTHLIB_INSECURE_TRANSPORT: "1"     # for http dev only; use https in prod
      WORKSPACE_EXTERNAL_URL: "http://mcp-google-workspace:8000"  # optional
    restart: unless-stopped
    working_dir: /app
    entrypoint: []
    command: >
      uv run main.py --transport streamable-http
      --tool-tier core --tools docs drive
    # ports:
    #   - "8000:8000"  # only if y

• LibreChat mcpServers config

mcpServers:
  google_workspace:
    type: streamable-http
    url: "http://mcp-google-workspace:8000/mcp"
    oauth:
      authorization_url: "https://accounts.google.com/o/oauth2/v2/auth"
      token_url: "https://oauth2.googleapis.com/token"
      client_id: xxxxx
      client_secret: yyyyy
      scope: "https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/documents.readonly https://www.googleapis.com/auth/documents"
      token_exchange_method: "default_post"
      redirect_uri: "http://localhost:3080/api/mcp/google_workspace/oauth/callback"  # exact match in Google Console
    initTimeout: 150000
    startup: false

Even though the authorization dance seems to have succeeded but I'm getting:

Input validation error: 'drive_service' is a required property

Error calling tool 'get_drive_file_content': An unexpected error occurred in get_drive_file_content: OAuth 2.1 mode requires an authenticated user for get_drive_file_content, but none was found.

Am I overcomplicating my configuration?

I've been reviewing taylorwilsdon/google_workspace_mcp#162 but I don't manage to nail it.

Thanks everyone!