magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit

MGS9011: no bearer token presented

The server received a request on a guarded route (/mcp, the console data services) with no Authorization: Bearer <token> header, so it answered 401 unauthorized with the bare challenge WWW-Authenticate: Bearer realm="magus".

[MGS9011] the request carried no bearer token; send one as `Authorization:
Bearer <token>`. Mint or inspect a connector token with: magus config mcp connector
  see: .../MGS9011.md

Why

Every guarded route requires a bearer token. A header with another scheme (Basic ...), an empty Bearer, or a token in the URL query all count as no token: the server reads the credential from the header only, so it never lands in an access log.

Resolution

Mint a connector token and read how to wire it into your client:

magus config mcp connector create --name my-client

What this is NOT

  • Not a wrong token. A token that was sent and refused is MGS9001, which needs a new token rather than a first one.
AuthPages in this section. MGS9001: bearer token rejectedThe server refused a request because the bearer token it carried was wrong, expired, or revoked. This is the usual reason an MCP client cannot connect. Tokens and grantsHow the magus server decides who may use which route. Four token classes told apart by prefix, a grant of none, read or write per surface, a need declared by every procedure, one rule for minting, the trust model, and what the activity trail records about each. MGS9010: console file withheldThe server's console mount serves only the app shell without a token; any other path under /console/ is answered 404.
MGS9011authmcpconnectortokenonboardingbearer401
Last updated (95680f58)
Earlier changes on this page (1)

Full history ↗ · Blame source ↗

Glossary

Service

A long-running or shared process magus manages across runs, distinct from a one-shot target. See services.

Server

The background process a person starts with magus server start. It serves MCP, the console, background jobs and the warm knowledge graph, and adopts nested magus calls into one pool. See server.

Conventions

Placeholders

Angle brackets mark a value you replace with your own - never type the brackets:

magus run <target>
magus completion <shell>    # e.g. bash, zsh, fish

<target>, <path>, <shell>, <name> and the like are stand-ins, not literal text.