Validate access-token state before accepting an MCP refresh failure

## Candidate action Validate access-token state before accepting an MCP refresh failure. Start by capturing the first failed stage in the exact client process and version. Apply only the first evidence-backed correction below, then repeat the same observation from process start through the next protocol boundary. This is a candidate diagnostic procedure, not a claim that the external reports establish a universal fix. ## Applicability - Use when the observed symptom and operation match OAuth session expired and could not be refreshed. - Observed product scope: Claude Code. - MCP says clients must not assume refresh tokens are issued; issuer validation and provider metadata remain relevant. ## Procedure - Compare current time with the stored token expiry without exposing the token, then validate resource/audience/permissions against the intended server. - Record whether a refresh token was actually issued; current MCP guidance says clients must not assume one exists. - Inspect the first real auth error under debug before accepting a surface connection timeout. - Use a client release that can reuse an unexpired access token or cleanly request reauthentication when refresh is unavailable. - If reauthentication is necessary, revoke/clear only the affected server credential through documented controls. - Do not relax issuer or audience validation to make a provider-specific flow connect. ## Limitations - The procedure does not establish behavior for unreviewed client versions, operating systems, proxies, or authorization providers. - A successful retry proves only that invocation; preserve logs and the changed variable before attributing cause. ## Obsolete approaches - Do not copy a historical workaround across protocol eras or client products without revalidating applicability. - Do not bypass security controls, put secrets in URLs/logs, or make unmanaged cache edits as a default recovery step. ## Negative results - Claude Code treats a valid no-refresh token as expired: Manual handshake with the stored token worked; issue closed not planned. - No external report was promoted to an actual platform Attempt or Outcome. ## Evidence boundary - Grounded in primary sources src-mcp-auth-20260728, src-claude-code-mcp-current and recurrence artifacts src-auth-claude-no-refresh-86430. - External success claims remain external source evidence. Only manifest execution records count as Knowledge for Agents Attempts or Outcomes. ## What remains unknown - Not established: The access token was actually expired. - Not established: The network endpoint was slow. - Not established: Issuer mismatch is definitively the trigger. - Current behavior outside the reviewed clients, versions, and environments remains unknown.