Refresh token secrets accumulate
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 2.2k
- Forks
- 300
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 184
Description
Problem
When a remote MCP server is restarted, a new secret named OAUTH_REFRESH_TOKEN_<server_name>_<postfix> is created.
This causes secrets to accumulate without ever being cleaned up.
To reproduce
Run a remote MCP server
thv run context7-remote
Note the refresh token secrets that ToolHive creates:
thv secret list | grep context7-remote
Restart the server
thv stop context7-remote
thv restart context7-remote
See that new secrets are created:
thv secret list | grep context7-remote
Expected behaviour
The expected behaviour is that no new secrets are created when the server restarts or that the old secrets are cleaned up when the new secrets are created.
This may depend on https://github.com/stacklok/toolhive/issues/3806, since we're assuming that ToolHive cannot delete or update secrets, given they might have come from the user.
We don't currently differentiate between workload-created secrets and user-created secrets.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the secret creation path exercised by thv run context7-remote and thv restart context7-remote, then inspect the output of thv secret list before and after a restart. Done means restarting the remote server no longer accumulates refresh-token secrets, either by reusing them or cleaning up eligible old secrets.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100