Hermes MCP OAuth Tokens Can Be Deleted After a Transient Reconnect Failure (#60694)
Bug Tracker — July 16, 2026. A documented MCP credential-loss incident reports that a brief transport failure can trigger token removal even when the refresh token has not been invalidated.
Issue Summary
Issue #60694 reports that after a transient keepalive or network failure, MCP reconnect handling can call remove() and permanently delete valid OAuth tokens from disk. The refresh token is not necessarily invalid, but users can lose MCP connectivity silently and must authenticate again by hand. The reported expected boundary is narrow: credentials should be removed only after an explicit invalid_grant response or a user-requested removal. Upstream marked the issue closed as not planned, so this page records a documented incident rather than an active tracker claim.
Observed Failure Path
| Step | Reported Behavior | User-Level Consequence |
|---|---|---|
| Transient transport fault | A keepalive or brief network failure interrupts MCP connectivity. | Normal recovery should retain valid credentials and retry or surface a bounded connection state. |
| Reconnect handling | Reported path calls remove() during reconnect. | Local OAuth token material can be deleted without an explicit credential-invalid signal. |
| Credential state | Refresh token was not necessarily invalidated. | User loses a valid authorization state and MCP connectivity can fail silently. |
| Recovery | Manual reauthentication is required. | Operator time and workflow continuity are lost after a transient condition. |
Operational Impact
Classification: P2. Status: Closed as not planned. This page summarizes a publicly reported issue; scope, remediation, and reproducibility can change. Validate the relevant Hermes version, MCP provider, and Linux service model before treating a workaround or closure as complete.
Mitigation and Verification
- Test MCP reconnect behavior with an approved test account and controlled transient network interruption; confirm that valid token files remain present after recovery attempts.
- Separate transport errors from OAuth invalidation: only an explicit
invalid_grantor user-directed disconnect should remove stored credentials. - Expose credential state and reconnect outcome to operators so a lost token is distinguishable from a temporary provider outage.
- Because issue #60694 is closed as not planned, review the current supported MCP authentication path and maintain a documented reauthentication procedure.
- Verify recovery with a real tool call after reconnect, not just a running gateway process.
Source Evidence
Primary issue: NousResearch/hermes-agent issue #60694
For a managed-agent comparison, the relevant question is whether credential recovery and liveness checks preserve state, return actionable status, and fail within a bounded time—not only whether a healthy happy path works.