Repository navigation
MCP Inspector Not Using Refresh Token for Token Validation #608
Description
The MCP Inspector should utilize the refresh_token to properly validate the token refresh flow.
Steps to Reproduce:
- Use a short-lived access token
- Log in and wait for the token to expire
- Send a request (e.g., list/tools)
Expected Behavior:
The token should be automatically refreshed when expired.
Actual Behavior:
The request fails with the following error:
MCP error -32001: Error POSTing to endpoint (HTTP 401): {"message":"Invalid or expired access token","error":"Unauthorized","statusCode":401}
Additional Issues:
- Clicking "reconnect" also fails to use the refresh_token
- A code search confirms that refresh_token is not implemented anywhere in the codebase
Impact:
This prevents proper evaluation of the Authorization specification, as the refresh token flow cannot be tested.
Reacted by SeungMin Park, Andy Young, Josiah "Rebase" Roberts, Konstantin Krauss, Panagiotis Mantafounis, Jonathan Korach, wizardist, Karandeep Johar and Ayush Thakur
Activity
olaservo commentedon Oct 26, 2025
Closing as duplicate of #665 which tracks the token refresh flow implementation.
rendyfebry commentedon Nov 1, 2025
Hi @olaservo
I don't think this is really duplicate issue.
The #665 expect refresh token flow to works when you intentionally click "Guided OAuth Flow" or "Quick OAuth Flow" in inspector Auth menu.
While this one is one step above that, the client should automatically trigger refresh token when it call the server with access token, but got token expiry error.
Ayushlm10 commentedon Nov 19, 2025
I was testing this with v0.16.0 where at least after clicking reconnect it works. But yeah, still does not refresh automatically.
erenatas commentedon Mar 3, 2026
I can confirm this is still an ongoing issue