aws / aws/amazon-q-developer-cli
Remote MCP OAuth re-authentication fails silently - Atlassian MCP server gets AuthRequired but transport closes instead of triggering OAuth flow. After initial token expires, Ctrl+Y does nothing and /mcp panel cannot re-authenticate. Logs show: worker quit
- Dominant language
- Rust
- Stars
- 2k
- Forks
- 439
- PR merge metrics
- No merged PRs in 30d
Description
### Checks
- [x] I have searched [github.com/aws/amazon-q-developer-cli/issues](https://github.com/aws/amazon-q-developer-cli/issues?q=) and there are no duplicates of my issue
- [x] I have run `q doctor` in the affected terminal session
- [x] I have run `q restart` and replicated the issue again
### Operating system
macOS 26.5.0 (25F71)
### Expected behaviour
When the Atlassian MCP OAuth token expires or is invalid, kiro-cli should present a new
OAuth authorization URL (via status bar / Ctrl+Y or /mcp panel) so the user can
re-authenticate in the browser.
### Actual behaviour
The MCP transport receives AuthRequired from the server and immediately closes the channel with a fatal error. No OAuth URL is presented.
Ctrl+Y does nothing. /mcp panel shows the server needs auth but pressing Enter doesn't trigger the flow. The only log output is:
worker quit with fatal: Transport channel closed, when AuthRequired(
"Missing or invalid access token"
)
### Steps to reproduce
1. Add Atlassian remote MCP server:
kiro-cli mcp add --scope global --url https://mcp.atlassian.com/v1/mcp --name atlasian
2. Authenticate successfully via the initial OAuth flow (browser opens, authorize, token is stored)
3. Wait for the token to expire (or remove keychain entries for kirocli:odic:token and kirocli:odic:device-registration)
4. Start a new kiro-cli session: kiro-cli chat
5. Trigger any Atlassian MCP tool (e.g. via an agent that uses @atlassian)
6. Observe: no OAuth URL is presented, Ctrl+Y does nothing, /mcp panel shows "needs auth" but Enter doesn't start the flow
### Environment
```yaml
[q-details]
version = "2.8.0"
hash = "63ca9ce0914a71fdf63af1de8458d7fd49fb6bf2"
date = "2026-06-17T03:19:51.788321Z (6h ago)"
variant = "full"
[system-info]
os = "macOS 26.5.0 (25F71)"
chip = "Apple M4 Pro"
total-cores = 14
memory = "24.00 GB"
[environment]
cwd = "/Users/USER/IdeaProjects/casino-product/eva-platform/platform-services/c-wallet"
cli-path = "/Users/USER/IdeaProjects/casino-product/eva-platform/platform-services/c-wallet"
os = "Mac"
shell-path = "/opt/homebrew/Cellar/rtk/0.42.0/bin/rtk"
terminal = "Ghostty"
install-method = "unknown"
[env-vars]
PATH = "/Users/USER/.bun/bin:/Users/USER/.jenv/shims:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/pkg/env/global/bin:/opt/homebrew/bin:/opt/podman/bin:/Users/USER/.cargo/bin:/Applications/cmux.app/Contents/Resources/bin:/Users/USER/.local/bin"
QTERM_SESSION_ID = "08d6e0e702df4ce5bcaf336a4e85b3f3"
Q_SET_PARENT_CHECK = "1"
Q_TERM = "2.8.0"
SHELL = "/bin/zsh"
TERM = "xterm-ghostty"
__CFBundleIdentifier = "com.cmuxterm.app"
```
Contributor guide
Research direction
Reproduce the expired-token case with the Atlassian remote MCP server, using `kiro-cli chat`, Ctrl+Y, and the `/mcp` panel. Start by tracing the MCP transport's `AuthRequired` handling and the `worker quit` fatal error. Done means an expired or invalid token presents a new OAuth authorization URL through the status bar, Ctrl+Y, or `/mcp` panel without closing the channel.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- authentication, cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100