Individual skill

mcp-oauth-triage

Use when an MCP connector that used to authenticate now fails (tool calls 401 after a good token exchange, breaks after refresh, returns another account's data), before changing code. Classifies the fault with oauth_triage.py.

engineering/skills/mcp-oauth-triage/SKILL.md

Read pinned source

Source commit 8f082544116fc0d014188e521ca40304cdfc86b0

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: No
Observed behavior: Network or broad shell
Last checked: Nov 10, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 29,647
Repository last updated: Nov 11, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agentic-ai Repository topic
anthropic-claude Repository topic
claude-ai Repository topic
claude-code Repository topic
claude-skills Repository topic
claude-code-skills Repository topic
ai-coding-agent Repository topic
claude-code-plugins Repository topic
developer-tools Repository topic
openai-codex Repository topic
data Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

README.mddoc · 3,918 bytes
SKILL.mdcore · 14,528 bytes
SKILL.mdcore · 14,528 bytes
SKILL.mdcore · 14,528 bytes
SKILL.mdcore · 14,528 bytes
SKILL.mdcore · 14,528 bytes
SKILL.mdcore · 14,528 bytes
SKILL.mdcore · 14,528 bytes
assets/fixtures/binding_record.jsonasset · 220 bytes
assets/fixtures/clean_events.jsonlasset · 174 bytes
assets/fixtures/clean_record.jsonasset · 236 bytes
assets/fixtures/envelope_record.jsonasset · 179 bytes
assets/fixtures/expiry_record.jsonasset · 123 bytes
assets/fixtures/negative_cache_events.jsonlasset · 139 bytes
assets/fixtures/negative_cache_record.jsonasset · 128 bytes
assets/fixtures/rotation_events.jsonlasset · 300 bytes
assets/fixtures/rotation_record.jsonasset · 109 bytes
examples/rotation-clobber-walkthrough.mddoc · 4,929 bytes
expected_outputs/verdicts.jsonasset · 1,339 bytes
references/failure-classes.mddoc · 7,309 bytes
references/verification-recipes.mddoc · 3,841 bytes
scripts/oauth_triage.pyruns · 20,288 bytes
scripts/run_fixtures.pyruns · 5,314 bytes

Read excerpt


# MCP OAuth Triage

**Tier:** POWERFUL · **Category:** Engineering · **Domain:** AI / Auth / Connectors

## Overview

An OAuth-backed MCP connector rarely fails at the exchange. It fails somewhere between storing what the
exchange returned and reading it back on the next call, so the visible symptom is a wall of 401s while
every dashboard says the connection is healthy.

The cost of guessing is high because five common faults share one symptom and need opposite fixes.
Rotating a client secret does nothing when the real fault is a writer and a reader disagreeing about
which key holds the token. Re-authenticating cures a poisoned auth cache for a day and hides the actual
defect. This skill exists to stop that guessing: collect three artifacts, run one classifier, fix the