fix: refresh expired MCP OAuth tokens #6209
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. Another round soon, please! ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Repro: - Set up an HTTP MCP server with OAuth expiring tokens like Datadog - Use it for a bit until the token expires - Start a new codex session Expected results: - The token gets transparently refreshed and the MCP server continues to work Actual results: - You start getting 401s and need to do `codex mcp logout` and log back in.
…pired
The old load path in codex-rs/rmcp-client/src/oauth.rs only set expires_in when the stored expiry was in the future:
// codex-rs/rmcp-client/src/oauth.rs:369-374 (original)
if let Some(expires_at) = entry.expires_at
&& let Some(seconds) = expires_in_from_timestamp(expires_at)
{
let duration = Duration::from_secs(seconds);
token_response.set_expires_in(Some(&duration));
}
And expires_in_from_timestamp returned None for expired tokens:
// codex-rs/rmcp-client/src/oauth.rs:444-453 (original)
if expires_at <= now_ms {
None
} else {
Some((expires_at - now_ms) / 1000)
}
So when the stored token was already expired, set_expires_in was never called, RMCP saw “no expiry,” and it didn’t auto-refresh on handshake.
JaviSoto
force-pushed
the
dev/javi/mcp-auth-refresh
branch
from
13da57b to
214ac14
Compare
|
Closing in favor of modelcontextprotocol/rust-sdk#509 |
Repro:
Expected results:
Actual results:
codex mcp logoutand log back in.