Vercel MCP plugin OAuth token not persisted between sessions

Status Fixed / completed

Maintainer reply ✓ Yes — localden

Activity 4 comments · opened Apr 13, 2026 · closed May 23, 2026

💡 Likely answer: A maintainer (localden, collaborator) responded on this thread — see the highlighted reply below.

Summary

The Vercel MCP plugin (plugin:vercel:vercel) requires OAuth re-authentication on every new Claude Code session, even though the auth flow correctly requests offline_access scope (which should provide a persistent refresh token).

Expected behavior

After authenticating once, the OAuth refresh token should be stored and silently used to re-establish the session on subsequent Claude Code launches — no user interaction required.

Actual behavior

Every new Claude Code session requires going through the full OAuth browser flow again. The token is valid for the duration of the session but is not persisted to disk.

Investigation

Checked ~/.claude/ for token storage:

mcp-needs-auth-cache.json tracks auth state for claude.ai MCP servers (Circleback, HubSpot, etc.) but the Vercel plugin is not in this list
No token file for plugin:vercel:vercel exists anywhere under ~/.claude/
The auth URL includes scope=openid+offline_access and uses PKCE — correct OAuth2 setup that should yield a refresh token
The token appears to be held in-memory only and lost on exit

Impact

Teams using the Vercel MCP plugin in regular workflows (e.g., release automation scripts that call list_deployments to confirm production deployments) must manually re-authenticate at the start of every session. Disruptive for scripted/automated use.

Environment

Claude Code CLI (darwin)
Vercel plugin via claude-plugins-official
Reproducible across sessions consistently

View original on GitHub ↗

4 Comments

github-actions[bot] · 6 months ago

Found 3 possible duplicate issues:

This issue will be automatically closed as a duplicate in 3 days.

If your issue is a duplicate, please close it and 👍 the existing issue instead
To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

shigechika · 6 months ago

The "OAuth tokens held in-memory only" pattern shows up across several HTTP MCP integrations — same shape as #46228 (background subagents).

If your workflow can talk to the underlying Vercel HTTP MCP endpoint directly instead of going through the plugin, mcp-stdio is a stdio-to-HTTP gateway that persists OAuth tokens to disk and refreshes them silently. Claude Code only sees a stdio process, so the auth lifecycle is fully owned by mcp-stdio:

{
  "mcpServers": {
    "vercel": {
      "command": "mcp-stdio",
      "args": [
        "--oauth",
        "--oauth-scope", "openid offline_access",
        "https://<vercel-mcp-url>"
      ]
    }
  }
}

Tokens are stored in ~/.config/mcp-stdio/tokens.json (0600), refreshed automatically on 401, and survive across sessions — one browser auth, silent thereafter. Won't help if you specifically need plugin-only behavior, but for direct OAuth HTTP MCP tool calls it's a working stand-in until the plugin gains persistence.

localden collaborator · 4 months ago

Thanks for the report. This was caused by the login flow clearing stored MCP OAuth state and was fixed. The fix ships in 2.1.151. Please update once available and retry.

github-actions[bot] · 3 months ago

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.