You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
MCP remote server permanently stuck as 'failed/unavailable' even with valid OAuth token #33012
Remote MCP servers (Supabase in this case) get permanently stuck in a status=failed / server unavailable state after a single connection hiccup. The client never retries the connection, and all subsequent tool calls return a misleading -32600 error.
Log evidence from ~/.local/share/opencode/log/opencode.log:
Irreversible failed state — Once the server is marked failed, it never recovers. No retry mechanism.
Token was valid the whole time — Manual curl to mcp.supabase.com with the stored OAuth token (sbp_oauth_... from mcp-auth.json) worked perfectly. The token issue was not expired or revoked.
Misleading error message — Tool calls return MCP error -32600: You do not have permission to perform this action, which suggests an auth problem. The real issue is the MCP session was never established.
Only workaround: nuke everything — Had to delete the Supabase entry from mcp-auth.json, run opencode mcp logout supabase and opencode mcp login supabase again to force a fresh session.
Steps to reproduce
Configure a remote MCP server (e.g., Supabase) with OAuth
Let the MCP connection fail once (network blip, server restart, rate limit, etc.)
Try calling any tool — it fails with -32600
The server remains unavailable for the entire session, across tool calls, regardless of token validity
Expected behavior
The MCP client should:
Retry failed server connections with exponential backoff
Re-initialize the MCP session when detecting a stale/broken session (Mcp-Session-Id expired/missing)
Return an accurate error message when the session is not established (not "permission denied")
Split remote MCP state into auth token state and transport session state. A valid OAuth token should not be treated as a valid live MCP session, and a broken session should not poison the server forever.
On tool-call failure, run a lightweight health check/reinitialize path, update status as auth_ok_transport_dead, reinitializing, or auth_failed, and retry with a bounded policy. Tool errors should report the exact layer that failed instead of returning a misleading permission error.
Activity
github-actions commentedon Jun 19, 2026
This issue might be a duplicate of existing issues. Please check:
failedafter one failure, no reconnect/retry logic)Please review those issues and consider adding your observations there if they cover the same problem.
Necmttn commentedon Jun 21, 2026
Split remote MCP state into auth token state and transport session state. A valid OAuth token should not be treated as a valid live MCP session, and a broken session should not poison the server forever.
On tool-call failure, run a lightweight health check/reinitialize path, update status as
auth_ok_transport_dead,reinitializing, orauth_failed, and retry with a bounded policy. Tool errors should report the exact layer that failed instead of returning a misleading permission error.Generated with ax.