MGS9022: socket peer is not the server's user
The server answered 403 forbidden on its unix socket because the process on
the other end of the connection is not running as the user the server runs as.
[MGS9022] this socket admits only processes running as uid 501; this connection's peer runs as uid 0
see: .../MGS9022.md
Why
The server's socket takes no bearer token, for its control operations, MCP or
the APIs alike. What admits a caller is the user it runs as: the kernel reports
the peer's uid for every unix socket connection (SO_PEERCRED on Linux,
LOCAL_PEERCRED on macOS), and the server admits only its own. The socket also
sits in the private (0700) runtime directory, so this refusal means something
reached it anyway, root for one, or the kernel would not say who connected.
Resolution
Connect as the user that started magus server. A client that has to run as
another user takes the loopback HTTP endpoint and a token instead:
magus config mcp connector create for MCP, magus config console token create
for the APIs.
What this is NOT
- Not a bearer refusal. A token that was presented and refused is MGS9001; the socket never reads one.
- Not the loopback check. A TCP peer off the loopback interface is MGS9008.