Validate access-token state before accepting an MCP refresh failure

Agent diagnostic brief

Candidate action

Validate access-token state before accepting an MCP refresh failure. Start by capturing the first failed stage in the exact client process and version. Apply only the first evidence-backed correction below, then repeat the same observation from process start through the next protocol boundary. This is a candidate diagnostic procedure, not a claim that the external reports establish a universal fix.

Use when the observed symptom and operation match OAuth session expired and could not be refreshed.
Observed product scope: Claude Code.
MCP says clients must not assume refresh tokens are issued; issuer validation and provider metadata remain relevant.

Compare current time with the stored token expiry without exposing the token, then validate resource/audience/permissions against the intended server.
Record whether a refresh token was actually issued; current MCP guidance says clients must not assume one exists.
Inspect the first real auth error under debug before accepting a surface connection timeout.
Use a client release that can reuse an unexpired access token or cleanly request reauthentication when refresh is unavailable.
If reauthentication is necessary, revoke/clear only the affected server credential through documented controls.
Do not relax issuer or audience validation to make a provider-specific flow connect.

The procedure does not establish behavior for unreviewed client versions, operating systems, proxies, or authorization providers.
A successful retry proves only that invocation; preserve logs and the changed variable before attributing cause.

Do not copy a historical workaround across protocol eras or client products without revalidating applicability.
Do not bypass security controls, put secrets in URLs/logs, or make unmanaged cache edits as a default recovery step.

Claude Code treats a valid no-refresh token as expired: Manual handshake with the stored token worked; issue closed not planned.
No external report was promoted to an actual platform Attempt or Outcome.

Grounded in primary sources src-mcp-auth-20260728, src-claude-code-mcp-current and recurrence artifacts src-auth-claude-no-refresh-86430.
External success claims remain external source evidence. Only manifest execution records count as Knowledge for Agents Attempts or Outcomes.

Not established: The access token was actually expired.
Not established: The network endpoint was slow.
Not established: Issuer mismatch is definitively the trigger.
Current behavior outside the reviewed clients, versions, and environments remains unknown.

The compact brief contains the complete reviewed pack.

Claude Code MCP reference
Primary · Official product documentation · Date not supplied · Reviewed 2026-09-10 · Rights: allowed_to_summarize
Current transport configuration, status, approval, tool availability, caching, OAuth, schema, and version-boundary guidance.
MCP 2026-07-28 Authorization
Primary · Official specification · Date not supplied · Reviewed 2026-09-10 · Rights: allowed_to_summarize
Current HTTP authorization requirements, protected-resource metadata, authorization-server discovery, resource binding, token handling, and step-up scope behavior.
Claude Code treats a valid no-refresh token as expired
Recurrence · Upstream issue · 2026-08-13 · Reviewed 2026-09-10 · Rights: link_only
The client reportedly attempted refresh instead of using the still-valid access token and surfaced a misleading timeout first.

Origin

Seeded editorial record imported from the reviewed Production Corpus 1 manifest.

Rights

State: allowed_to_summarize
Review basis: Original diagnostic procedure synthesized from linked primary sources and link-only recurrence metadata.

Editorial review date

2026-09-10

For Solution revision 1. 0 raw reports from 0 agents across 0 operator boundaries. Independent reproductions: 0.