fix(core): refresh MCP OAuth token usage after re-auth by sahilkirad · Pull Request #26312 · google-gemini/gemini-cli

sahilkirad · 2026-05-01T04:34:36Z

Summary

Fixes MCP OAuth token reuse after token refresh/re-auth.

Previously, transport auth could continue using a stale access token until CLI restart.
This change makes token retrieval dynamic so refreshed/stored tokens are used without restarting Gemini CLI.

Closes #18895

Details

Added a dynamic OAuth auth provider path in MCP transport creation.
For oauth.enabled servers, token is fetched via getValidToken(...) at auth time.
For stored-token flow (without explicit oauth.enabled), token is also resolved dynamically.
Added/updated regression coverage in MCP client transport OAuth tests to verify dynamic token behavior.

Related issues

CLI cannot use fresh token in MCP OAuth #18895

Validation

Ran successfully:

npm run build --workspace @google/gemini-cli-core
npm run test --workspace @google/gemini-cli-core -- src/tools/mcp-client.test.ts
- Result: all tests passed (including OAuth transport cases)

Notes

No user-facing command/flag changes.
No docs update required for this fix.

gemini-code-assist · 2026-05-01T04:34:46Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses an issue where MCP OAuth tokens would become stale, requiring a full CLI restart to refresh. By introducing a dynamic token provider, the system now resolves tokens at the time of authentication, ensuring that refreshed or updated credentials are used immediately. This change improves the robustness of the Gemini CLI's authentication flow for MCP servers.

Highlights

Dynamic OAuth Token Retrieval: Implemented a dynamic token provider for MCP transports, ensuring that OAuth tokens are refreshed or retrieved at request time rather than being cached at transport creation.
Improved Auth Handling: Updated the transport creation logic to support both explicit OAuth-enabled servers and stored-token flows, allowing for seamless re-authentication without requiring a CLI restart.
Regression Testing: Added comprehensive test cases to verify that the MCP client correctly utilizes the dynamic auth provider for both new and stored OAuth tokens.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request implements dynamic OAuth token retrieval for MCP clients by introducing the DynamicStoredOAuthProvider class. This allows tokens to be looked up or refreshed at request time rather than being fixed at transport creation. The createTransport function was updated to utilize this dynamic provider when OAuth is enabled or stored credentials are detected. Feedback was provided regarding the efficiency of the tokens() method in DynamicStoredOAuthProvider, specifically noting that instantiating storage and provider classes within the method leads to redundant disk I/O and should be refactored to use instance-scoped fields.

…(core): align MCP authProvider assertions with tokens() API

sahilkirad · 2026-05-01T05:46:58Z

Hi maintainers, all requested MCP OAuth fixes are pushed and tests were updated accordingly.
Evaluate Steering & Regressions is currently waiting for eval-gate deployment approval.
Could you please approve the eval-gate environment for this PR? Thank you.

scidomino

Gemini spotted two issues:

Severe Performance Hit on HTTP Transports: The MCP SDK’s StreamableHTTPClientTransport calls authProvider.tokens() for every single RPC request (inside _commonHeaders()).
- DynamicStoredOAuthProvider.tokens() delegates to oauthProvider.getValidToken().
- getValidToken() calls tokenStorage.getCredentials(), which reads and parses the JSON file from the disk (or queries the system Keychain if using encrypted storage) synchronously/asynchronously.
- Impact: This means every single MCP message sent via HTTP will perform a disk read or a slow Keychain lookup.
- Recommendation: DynamicStoredOAuthProvider should cache the accessToken and expiresAt in memory, and only re-fetch/refresh when the token is expired (e.g., adding a 5-minute buffer).
Redundant Storage Reads on Fallback: When oauth.enabled is falsy in the config, the tokens() method manually retrieves the clientId by calling this.tokenStorage.getCredentials(this.serverName). It then passes this clientId to this.oauthProvider.getValidToken(...), which internally calls getCredentials(...) again. This results in two back-to-back disk/keychain reads for a single request.
- Recommendation: Can be fixed by reusing the retrieved credentials or by caching in memory (as per issue #1).

sahilkirad · 2026-05-05T00:41:09Z

Okay @scidomino sir will do those changes

sahilkirad · 2026-05-05T09:45:36Z

Hello @scidomino sir i have fixed the issues:

Added in-memory token caching in DynamicStoredOAuthProvider with a 5-minute buffer.
Avoided redundant storage reads in fallback flow.
Updated/added tests for dynamic authProvider behavior and caching path.

Validated locally:

npm run test --workspace @google/gemini-cli-core -- src/tools/mcp-client.test.ts
npm run build --workspace @google/gemini-cli-core

scidomino · 2026-05-11T18:44:51Z

The architectural shift to a dynamic McpAuthProvider is the correct, "SDK-native" way to solve the stale token problem. However, the current implementation is overengineered in its complexity but inefficient in its execution.

Move Logic to a Dedicated Service:
- DynamicStoredOAuthProvider adds ~130 lines to mcp-client.ts, which is already too large.
- Recommendation: Move this class to its own file (e.g., packages/core/src/mcp/stored-token-provider.ts). This aligns with how GoogleCredentialProvider and ServiceAccountImpersonationProvider are structured.
Eliminate Redundant Storage Reads:
- The current implementation reads from the disk up to three times for a single token retrieval: once to check existence, once in getValidToken, and once more to manually extract expiration metadata.
- Recommendation: Refactor MCPOAuthProvider to return the full token metadata (including expiresAt) in one go. Additionally, in createTransport, just check for the existence of credentials rather than performing a full token validation before instantiating the provider.
Simplify tokens() Logic:
- The logic in the tokens() method regarding the // return fresh token comment is confusing. If a token doesn't have an expiry, it should still be handled cleanly without resetting the cache in a way that implies an error.

sahilkirad · 2026-05-11T18:48:14Z

The architectural shift to a dynamic McpAuthProvider is the correct, "SDK-native" way to solve the stale token problem. However, the current implementation is overengineered in its complexity but inefficient in its execution.

Move Logic to a Dedicated Service:

DynamicStoredOAuthProvider adds ~130 lines to mcp-client.ts, which is already too large.

Recommendation: Move this class to its own file (e.g., packages/core/src/mcp/stored-token-provider.ts). This aligns with how GoogleCredentialProvider and ServiceAccountImpersonationProvider are structured.

Eliminate Redundant Storage Reads:

The current implementation reads from the disk up to three times for a single token retrieval: once to check existence, once in getValidToken, and once more to manually extract expiration metadata.

Recommendation: Refactor MCPOAuthProvider to return the full token metadata (including expiresAt) in one go. Additionally, in createTransport, just check for the existence of credentials rather than performing a full token validation before instantiating the provider.

Simplify tokens() Logic:

The logic in the tokens() method regarding the // return fresh token comment is confusing. If a token doesn't have an expiry, it should still be handled cleanly without resetting the cache in a way that implies an error.

Surely @scidomino sir I'll implement these changes

…en flow

sahilkirad · 2026-05-12T19:45:48Z

The architectural shift to a dynamic McpAuthProvider is the correct, "SDK-native" way to solve the stale token problem. However, the current implementation is overengineered in its complexity but inefficient in its execution.

Move Logic to a Dedicated Service:

DynamicStoredOAuthProvider adds ~130 lines to mcp-client.ts, which is already too large.

Recommendation: Move this class to its own file (e.g., packages/core/src/mcp/stored-token-provider.ts). This aligns with how GoogleCredentialProvider and ServiceAccountImpersonationProvider are structured.

Eliminate Redundant Storage Reads:

The current implementation reads from the disk up to three times for a single token retrieval: once to check existence, once in getValidToken, and once more to manually extract expiration metadata.

Recommendation: Refactor MCPOAuthProvider to return the full token metadata (including expiresAt) in one go. Additionally, in createTransport, just check for the existence of credentials rather than performing a full token validation before instantiating the provider.

Simplify tokens() Logic:

The logic in the tokens() method regarding the // return fresh token comment is confusing. If a token doesn't have an expiry, it should still be handled cleanly without resetting the cache in a way that implies an error.

hello @scidomino sir i am done with the changes ,
Implemented the requested changes for MCP OAuth token handling.

Moved DynamicStoredOAuthProvider out of mcp-client.ts into packages/core/src/mcp/stored-token-provider.ts.
Refactored token retrieval to use MCPOAuthProvider.getValidTokenWithMetadata(...) so token + expiry metadata come from one provider path.
Removed redundant follow-up storage reads in dynamic token flow.
Kept createTransport on credential-existence gating only (no eager full token validation).
Simplified tokens() behavior for no-expiry tokens: return token cleanly without long fallback caching semantics.
Updated tests in mcp-client.test.ts to match new call behavior and metadata path; targeted suite passes locally.

scidomino · 2026-05-12T22:33:13Z

You have broken E2E tests. please fix.

sahilkirad · 2026-05-13T01:39:51Z

You have broken E2E tests. please fix.

Sure @scidomino sir I'll do it

sahilkirad · 2026-05-13T03:57:00Z

Hello @scidomino sir i have fixed the issue please could you grant the github actions workflow execution

sahilkirad · 2026-05-13T16:52:27Z

Hello @scidomino sir ,I fixed the deterministic E2E failure in integration-tests/file-system.test.ts (newline normalization). Current remaining failures are in test:always_passing_evals with repeated 503 retries and cross-suite timeouts (not tied to changed files). Could you please re-run eval gates?”

github-actions · 2026-05-13T18:58:26Z

🚨 Action Required: Eval Regressions Detected

Model: gemini-3-flash-preview

The following trustworthy evaluations passed on main and in recent Nightly runs, but failed in this PR. These regressions must be addressed before merging.

Test Name	Nightly	PR Result	Status
should create a plan in plan mode and implement it for a refactoring task	94%	0%	❌ Regression

The check passed or was cleared for 79 other trustworthy evaluations.

🛠️ Troubleshooting & Fix Instructions

1. Ask Gemini CLI to fix it (Recommended)

Copy and paste this prompt to the agent:

The eval "should create a plan in plan mode and implement it for a refactoring task" in evals/plan_mode.eval.ts is failing. Investigate and fix it using the behavioral-evals skill.

2. Reproduce Locally

Run the following command to see the failure trajectory:

GEMINI_MODEL=gemini-3-flash-preview npm run test:all_evals -- evals/plan_mode.eval.ts --testNamePattern="should create a plan in plan mode and implement it for a refactoring task"

3. Manual Fix

See the Fixing Guide for detailed troubleshooting steps.

### 🧠 Model Steering Guidance

This PR modifies files that affect the model's behavior (prompts, tools, or instructions).

⚠️ Consider adding Evals: No behavioral evaluations (evals/*.eval.ts) were added or updated in this PR. Consider adding a test case to verify the new behavior and prevent regressions.

This is an automated guidance message triggered by steering logic signatures.

…#26312) Co-authored-by: Tommaso Sciortino <[email protected]>

fix(core): use fresh OAuth token for MCP transport after re-auth

7c20203

sahilkirad requested a review from a team as a code owner May 1, 2026 04:34

sahilkirad had a problem deploying to eval-gate May 1, 2026 04:35 — with GitHub Actions Error

gemini-code-assist Bot reviewed May 1, 2026

View reviewed changes

Comment thread packages/core/src/tools/mcp-client.ts Outdated

gemini-cli Bot added priority/p2 Important but can be addressed in a future release. area/core Issues related to User Interface, OS Support, Core Functionality help wanted We will accept PRs from all issues marked as "help wanted". Thanks for your support! labels May 1, 2026

sahilkirad added 2 commits May 1, 2026 10:59

test(core): align MCP authProvider assertions with tokens() API

aec94ad

updated mcp-client.ts file to reuse oauth provider instances and test…

3940713

…(core): align MCP authProvider assertions with tokens() API

sahilkirad requested review from a team as code owners May 1, 2026 05:31

sahilkirad had a problem deploying to eval-gate May 1, 2026 05:32 — with GitHub Actions Error

chore: remove unrelated docs change from PR

3a9b8a9

sahilkirad had a problem deploying to eval-gate May 1, 2026 05:38 — with GitHub Actions Error

sahilkirad mentioned this pull request May 1, 2026

test(acp): add missing coverage for extensions command error paths #25313

Merged

scidomino requested changes May 4, 2026

View reviewed changes

github-actions Bot mentioned this pull request May 5, 2026

📊 AI CLI 工具社区动态日报 2026-05-05 gsscsd/big_model_radar#295

Open

cache dynamic MCP OAuth tokens and avoid redundant storage reads

63f48cf

sahilkirad had a problem deploying to eval-gate May 5, 2026 09:44 — with GitHub Actions Error

sahilkirad requested a review from scidomino May 5, 2026 09:46

gemini-cli Bot added the area/extensions Issues related to Gemini CLI extensions capability label May 10, 2026

cache MCP OAuth tokens safely and avoid redundant storage reads

ecd64a8

sahilkirad had a problem deploying to eval-gate May 11, 2026 03:43 — with GitHub Actions Error

eliminate redundant MCP OAuth storage reads and simplify dynamic tok…

53f694b

…en flow

sahilkirad had a problem deploying to eval-gate May 12, 2026 19:44 — with GitHub Actions Error

scidomino approved these changes May 12, 2026

View reviewed changes

scidomino enabled auto-merge May 12, 2026 21:34

Merge branch 'main' into feature-sahil-mcp-oauth-issue-fix

fbaa762

scidomino had a problem deploying to eval-gate May 12, 2026 22:19 — with GitHub Actions Error

This was referenced May 13, 2026

📊 AI CLI 工具社区动态日报 2026-05-13 gsscsd/big_model_radar#336

Open

📊 AI CLI 工具社区动态日报 2026-05-13 ivanweng2077/big_model_radar#35

Open

fixed E2E pipeline issue

2217232

auto-merge was automatically disabled May 13, 2026 03:54
Head branch was pushed to by a user without write access

sahilkirad temporarily deployed to eval-gate May 13, 2026 03:54 — with GitHub Actions Inactive

sahilkirad requested a review from scidomino May 13, 2026 03:56

scidomino enabled auto-merge May 13, 2026 16:11

scidomino disabled auto-merge May 13, 2026 19:01

scidomino merged commit fd01cc0 into google-gemini:main May 13, 2026
29 checks passed

sripasg added the size/l A large sized PR label Jun 2, 2026

software-0ficial pushed a commit to software-0ficial/gemini-cli that referenced this pull request Jul 9, 2026

fix(core): refresh MCP OAuth token usage after re-auth (google-gemini…

afcc4e4

…#26312) Co-authored-by: Tommaso Sciortino <[email protected]>

Uh oh!

Conversation

sahilkirad commented May 1, 2026

Summary

Details

Related issues

Validation

Notes

Uh oh!

gemini-code-assist Bot commented May 1, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

sahilkirad commented May 1, 2026

Uh oh!

scidomino left a comment

Choose a reason for hiding this comment

Uh oh!

sahilkirad commented May 5, 2026

Uh oh!

sahilkirad commented May 5, 2026

Uh oh!

scidomino commented May 11, 2026

Uh oh!

sahilkirad commented May 11, 2026

Uh oh!

sahilkirad commented May 12, 2026

Uh oh!

scidomino commented May 12, 2026

Uh oh!

sahilkirad commented May 13, 2026

Uh oh!

sahilkirad commented May 13, 2026

Uh oh!

sahilkirad commented May 13, 2026

Uh oh!

github-actions Bot commented May 13, 2026

🚨 Action Required: Eval Regressions Detected

1. Ask Gemini CLI to fix it (Recommended)

2. Reproduce Locally

3. Manual Fix

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants