Gemini CLI fixes MCP OAuth refresh bug that was deleting recoverable credentials
ParthivNaresh · ghdev · 2026-07-22
A google-gemini/gemini-cli PR fixes a bug in MCP OAuth token refresh for servers configured through OAuth discovery and dynamic client registration.
What was broken:
- Refresh could fail locally before any network request was sent.
- The code looked up the client ID from stored credentials, but passed an empty config into the refresh flow.
- When refresh failed, the catch path deleted recoverable credentials, forcing users to re-authenticate on every reconnect.
What the fix does:
- Uses config.clientId ?? credentials.clientId.
- Passes the resolved client ID into refresh calls.
- Persists that client ID with the refreshed token.
- Applies the same fix in both the metadata and non-metadata token paths.
The PR includes tests and an end-to-end validation path for short-lived tokens and real DCR-enabled servers.
More from coding & agent
- The browser main thread is expensive: a practical guide to JavaScript and CSS animation cost — jh3yy · 2026-09-11
- Inspired by OpenAI's 10,000-agent run, dev open-sources a crowdsourced agent problem-solving platform — Benjaminsen · 2026-09-11
- Lucid: open-source Mac app keeps your laptop awake only while AI agents run — Pitiful_Hedgehog_600 · 2026-09-11
- banteg's snail project crowdsources AI agents to finish matching Snail Mail's 20 remaining functions — banteg · 2026-09-11
- Alex Townsend posts 200 open problems in numerical linear algebra for humans and AI agents — IgorCarron · 2026-09-11
- Kimi K2.8 Preview rolls out: near-K3 coding performance, 1M context for all tiers — teortaxesTex · 2026-09-11