Summary
Adding a streamable-http MCP server that requires OAuth login (e.g. Higgsfield's https://mcp.higgsfield.ai/mcp) works — the server registers and shows a "Login" button — but clicking Login always fails with a generic 500.
Environment
- aioncore version: v0.1.62 (reproduced; changelogs through v0.1.68 show no related fix)
- Deployment: web-only host (AIONUI_ALLOW_REMOTE=1, AIONUI_HOST=0.0.0.0)
Steps to reproduce
- Add an MCP server with
transport: { type: "http", url: "https://mcp.higgsfield.ai/mcp" } via POST /api/mcp/servers
- UI shows the server with a "Login" button (OAuth required)
- Click Login →
POST /api/mcp/oauth/login with the server id
Actual result
POST /api/mcp/oauth/login -> 500
{"success":false,"error":"Internal server error.","code":"INTERNAL_ERROR"}
Server log for the request:
ERROR aionui_app::router::trace: http response request_id=31f6a7f9 method=POST path=/api/mcp/oauth/login query_keys= status=500 latency_ms=79 error_code="INTERNAL_ERROR" error_message="Internal server error."
No further detail is logged — just the generic HTTP-layer wrapper log line, no underlying panic/error trace, even at DEBUG level.
Expected result
Either the OAuth authorization flow starts successfully (e.g. returns a redirect/authorization URL), or a specific, actionable error is returned and logged.
Notes
POST /api/mcp/test-connection for the same server returns 200 with status=error, tool_count=0 (transport-level auth challenge, expected before login).POST /api/mcp/oauth/check-status for the same server returns 200 (presumably "not authenticated").- Only
/api/mcp/oauth/login fails, and it fails fast (79ms), suggesting an early unhandled error rather than a network timeout talking to the MCP server's OAuth endpoint.
- Malformed request bodies to this same endpoint correctly return
400 BAD_REQUEST with "Invalid JSON request body.", so request validation works — the 500 happens after validation, inside the login handler itself.
Summary
Adding a streamable-http MCP server that requires OAuth login (e.g. Higgsfield's
https://mcp.higgsfield.ai/mcp) works — the server registers and shows a "Login" button — but clicking Login always fails with a generic 500.Environment
Steps to reproduce
transport: { type: "http", url: "https://mcp.higgsfield.ai/mcp" }viaPOST /api/mcp/serversPOST /api/mcp/oauth/loginwith the server idActual result
Server log for the request:
No further detail is logged — just the generic HTTP-layer wrapper log line, no underlying panic/error trace, even at DEBUG level.
Expected result
Either the OAuth authorization flow starts successfully (e.g. returns a redirect/authorization URL), or a specific, actionable error is returned and logged.
Notes
POST /api/mcp/test-connectionfor the same server returns200withstatus=error, tool_count=0(transport-level auth challenge, expected before login).POST /api/mcp/oauth/check-statusfor the same server returns200(presumably "not authenticated")./api/mcp/oauth/loginfails, and it fails fast (79ms), suggesting an early unhandled error rather than a network timeout talking to the MCP server's OAuth endpoint.400 BAD_REQUESTwith"Invalid JSON request body.", so request validation works — the 500 happens after validation, inside the login handler itself.