# Initiate MCP OAuth flow on post-initialize 401 responses \(\#60236\) · gitcafe/zed

[View on GitCafe](https://git.cafe/gitcafe/zed/commit/12e1e24434ebecaa5d81e6d8f08f4c9c4f8cbc14)

Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed)

Visibility: public

Requested revision: 12e1e24434ebecaa5d81e6d8f08f4c9c4f8cbc14

Requested commit: 12e1e24434ebecaa5d81e6d8f08f4c9c4f8cbc14

Commit: 12e1e24434ebecaa5d81e6d8f08f4c9c4f8cbc14

Tree: 2da641de777329cd7e2f44efb602612c2f1d1d34

Author: bgfraser

Committer: GitHub

## Message

```
Initiate MCP OAuth flow on post-initialize 401 responses (#60236)

MCP servers may accept `initialize` unauthenticated but return `401`
with a `WWW-Authenticate` challenge only on a later request such as
`tools/list` or `tools/call`. Previously Zed only started the Auth flow
when `initialize` itself was challenged, so these servers failed
opaquely and stayed stuck in `Running` with a dead client.

`ContextServerStore` now handles `TransportError::AuthRequired` returned
from any request, not just startup: it runs Auth discovery and
transitions the server into `AuthRequired` so the UI offers to
authenticate. The discovery logic is shared with the startup path, and
the tool/prompt request sites route their errors through it.

Release Notes:

- Fixed MCP servers that require auth only on tool calls (not on
`initialize`) failing to prompt for authentication.

---------

Co-authored-by: Tom Houlé <tom@tomhoule.com>
```

## Parents

- [262fb9ba2a58859c2eef7814249f4d266b065179](https://git.cafe/gitcafe/zed/commit/262fb9ba2a58859c2eef7814249f4d266b065179?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zed/tree/12e1e24434ebecaa5d81e6d8f08f4c9c4f8cbc14?format=markdown)