Gemini CLI fixes MCP OAuth refresh bug that was deleting recoverable credentials
ParthivNaresh · ghdev · 2026-07-22
A google-gemini/gemini-cli PR fixes a bug in MCP OAuth token refresh for servers configured through OAuth discovery and dynamic client registration.
What was broken:
- Refresh could fail locally before any network request was sent.
- The code looked up the client ID from stored credentials, but passed an empty config into the refresh flow.
- When refresh failed, the catch path deleted recoverable credentials, forcing users to re-authenticate on every reconnect.
What the fix does:
- Uses config.clientId ?? credentials.clientId.
- Passes the resolved client ID into refresh calls.
- Persists that client ID with the refreshed token.
- Applies the same fix in both the metadata and non-metadata token paths.
The PR includes tests and an end-to-end validation path for short-lived tokens and real DCR-enabled servers.
More from coding & agent
- Hermes Agent used as browser QA tester finds 8 issues in a bug-seeded site — techlatest_net · 2026-10-27
- Open-source FableCut lets AI agents edit a real video timeline via remote MCP — FastPresence9799 · 2026-10-27
- Redditor runs Hermes Agent in a dedicated Ubuntu VM to test real tasks — techlatest_net · 2026-10-27
- Developer drops VS Code, Office and git client, now uses only Claude — One_Improvement_6470 · 2026-10-27
- Grok bot makes its first real purchase, spots hidden prompt injection at checkout and ignores it — msg · 2026-10-27
- Swarmatory: Open-source shared chatroom/feed for your team's coding agents — qhoxie · 2026-10-27