Summary
A thv run connection to a vMCP gateway authenticated with --remote-auth becomes unauthenticated after approximately one hour. The runner logs a 401 and marks the remote server unauthenticated. thv restart does not initiate or recover authentication; it immediately receives another 401. Removing the server and running it again is currently required to restore the connection.
The gateway URL has been intentionally redacted for privacy.
Reproduction
- Run a vMCP gateway using remote authentication:
thv run <redacted-vmcp-gateway-url> --remote-auth --name stacklok-vmcp --remote-auth-scopes openid,profile,email,offline_access
- Keep the connection active for about one hour.
- Observe the server transition to unauthenticated after a 401 response.
- Run
thv restart stacklok-vmcp.
Actual behavior
The client logs:
{"time":"2026-09-08T17:41:06-04:00","level":"WARN","msg":"received 401 Unauthorized response for remote server, marking as unauthenticated","server":"stacklok-vmcp"}Restarting immediately encounters another 401 and does not recover the session.
Expected behavior
With the offline_access scope, ToolHive should refresh or otherwise re-establish remote authentication when the access token or session expires. A restart should recover an expired authentication session or provide an actionable re-authentication flow without requiring removal and recreation of the server.
Impact
Long-running vMCP gateway connections require manual removal and re-creation after token or session expiry.
Summary
A
thv runconnection to a vMCP gateway authenticated with--remote-authbecomes unauthenticated after approximately one hour. The runner logs a 401 and marks the remote server unauthenticated.thv restartdoes not initiate or recover authentication; it immediately receives another 401. Removing the server and running it again is currently required to restore the connection.The gateway URL has been intentionally redacted for privacy.
Reproduction
thv restart stacklok-vmcp.Actual behavior
The client logs:
{"time":"2026-09-08T17:41:06-04:00","level":"WARN","msg":"received 401 Unauthorized response for remote server, marking as unauthenticated","server":"stacklok-vmcp"}Restarting immediately encounters another 401 and does not recover the session.
Expected behavior
With the
offline_accessscope, ToolHive should refresh or otherwise re-establish remote authentication when the access token or session expires. A restart should recover an expired authentication session or provide an actionable re-authentication flow without requiring removal and recreation of the server.Impact
Long-running vMCP gateway connections require manual removal and re-creation after token or session expiry.