Fix MCP startup stall, add browser auth, validate auth status - #6
Open
BrewingCoder wants to merge 2 commits into
Open
Fix MCP startup stall, add browser auth, validate auth status#6BrewingCoder wants to merge 2 commits into
BrewingCoder wants to merge 2 commits into
Conversation
MCP server:
- Disable FastMCP 3.x startup network update-check and banner
(FASTMCP_CHECK_FOR_UPDATES=off, FASTMCP_SHOW_SERVER_BANNER=false) before
importing fastmcp. The update-check added a ~3s network stall during stdio
startup that could exceed Claude Desktop's init timeout and surface as
"can't connect to MCP server". Also pass show_banner=False to stdio run().
Auth:
- Add browser-based interactive login (login_browser via MSAL
acquire_token_interactive) and a new `outpost auth login` command
(--device falls back to device-code). Device-code flow is blocked by
Conditional Access in many tenants ("authentication flow restricted by
your admin", AADSTS); browser auth-code+PKCE sidesteps it. `outpost setup`
now uses the browser flow.
- Fix get_auth_status: validate the cached token instead of only checking
for a cached account. An expired refresh token (90-day inactivity) or
scope change now reports not-logged-in with a "run 'outpost auth login'"
message, instead of falsely reporting "Logged in".
Tests: update setup tests to patch login_browser; add coverage for expired
auth status, the new auth login command, and browser/device flow selection.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Reflect the switch from device-code to browser interactive login: note that `outpost setup` opens the browser, surface the new `outpost auth login` re-auth command, and update the wiki link description. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three related fixes uncovered while debugging "Claude can't connect to MCP server" and an inability to re-authenticate.
MCP server startup
FastMCP 3.x runs a network update-check + banner at startup, adding a ~3s stall before the stdio transport is ready. On a slow/offline network that can exceed Claude Desktop's init timeout and surface as "can't connect to MCP server". Disabled both (
FASTMCP_CHECK_FOR_UPDATES=off,FASTMCP_SHOW_SERVER_BANNER=false) before importing fastmcp, plusshow_banner=Falseon the stdio run. Startup: ~3s → ~1s.Browser authentication
Device-code flow is blocked by Conditional Access in many tenants ("an authentication flow that is restricted by your admin", AADSTS), making re-auth impossible. Added MSAL interactive browser login (
login_browser, auth code + PKCE) and a newoutpost auth logincommand (--devicefalls back to device-code).outpost setupnow uses the browser flow.Auth status validation
get_auth_status()only checked for a cached account, so it reported "Logged in" even with a dead token (90-day refresh-token expiry). It now validates the token viaacquire_token_silent_with_errorand reports "Session expired — run 'outpost auth login'" when it can't be silently renewed.Docs
outpost auth login, wiki link wording.Setup-&-Authenticationupdated (separate repo).Tests
345 passing. Updated setup tests to patch
login_browser; added coverage for expired auth status, the newauth logincommand, and browser/device flow selection.