Gemini CLI fixes MCP OAuth refresh bug that was deleting recoverable credentials
ParthivNaresh · ghdev · 2026-07-22
A google-gemini/gemini-cli PR fixes a bug in MCP OAuth token refresh for servers configured through OAuth discovery and dynamic client registration.
What was broken:
- Refresh could fail locally before any network request was sent.
- The code looked up the client ID from stored credentials, but passed an empty config into the refresh flow.
- When refresh failed, the catch path deleted recoverable credentials, forcing users to re-authenticate on every reconnect.
What the fix does:
- Uses config.clientId ?? credentials.clientId.
- Passes the resolved client ID into refresh calls.
- Persists that client ID with the refreshed token.
- Applies the same fix in both the metadata and non-metadata token paths.
The PR includes tests and an end-to-end validation path for short-lived tokens and real DCR-enabled servers.
More from coding & agent
- Warp's six non-engineering teams all run on Linear and Claude Code — mon__lim · 2026-09-11
- Is inference latency becoming the biggest bottleneck for production AI agents? — Euphoric_Sea632 · 2026-09-11
- Anthropic researcher: 99% of engineers now run swarms of 300+ self-improving agents — AlishaOutridge · 2026-09-11
- Gergely Orosz: Shipping 10x PRs With AI Agents, Sites Fill With Small Regressions — ducha_aiki · 2026-09-11
- Same Echo Maze prompt, three frontier models: all passed visually but shipped the same hidden bug — eyishazyer · 2026-09-11
- Astra storyboards plus Minimax H3 per-shot generation boost video success rates — Hailuo_AI · 2026-09-11