MCP Server Stuck "Unauthorized" Despite Completed OAuth (Stale Cache)¶
Notes¶
Summary¶
Summary¶
An MCP server (Notion, in the observed case) can show as unauthorized/no-tools-available in a session even after OAuth has genuinely completed and OpenClaw's own registry confirms it (openclaw mcp doctor <server> --probe → ok). Repeated openclaw gateway restart does not fix it.
Root cause: Claude CLI (the runtime backing the session) keeps its own cache of which MCP servers still need authorization, at ~/.claude/mcp-needs-auth-cache.json. If a server's entry was cached before the OAuth login actually completed, that stale entry persists and Claude CLI keeps treating the server as unauthorized — independent of what OpenClaw's registry says — so its tools never get projected into the session, no matter how many times the gateway restarts.
Fix¶
- Confirm true auth status first:
openclaw mcp doctor <server> --probe. - If OpenClaw says authorized but the session still can't see the server's tools, check
~/.claude/mcp-needs-auth-cache.jsonfor a stale entry for that server. - Remove that server's key from the cache file (leave other genuinely-unauthorized servers' entries alone).
- Important: the currently-running session process already loaded the old cache and won't self-refresh mid-conversation. Start a fresh session to actually pick up the fix — the fallback if that's not enough is
openclaw gateway restart.