---
title: "MGS9022: socket peer is not the server's user"
description: The server refused a request on its unix socket because the connecting process runs as another user, or the kernel did not report which user it runs as. Answered 403.
tags: [MGS9022, auth, server, socket, peer, "403"]
---

# MGS9022: socket peer is not the server's user

The server answered `403 forbidden` on its unix socket because the process on
the other end of the connection is not running as the user the server runs as.

```text
[MGS9022] this socket admits only processes running as uid 501; this connection's peer runs as uid 0
  see: .../MGS9022.md
```

## Why

The server's socket takes no bearer token, for its control operations, MCP or
the APIs alike. What admits a caller is the user it runs as: the kernel reports
the peer's uid for every unix socket connection (`SO_PEERCRED` on Linux,
`LOCAL_PEERCRED` on macOS), and the server admits only its own. The socket also
sits in the private (`0700`) runtime directory, so this refusal means something
reached it anyway, root for one, or the kernel would not say who connected.

## Resolution

Connect as the user that started `magus server`. A client that has to run as
another user takes the loopback HTTP endpoint and a token instead:
`magus config mcp connector create` for MCP, `magus config console token create`
for the APIs.

## What this is NOT

- **Not a bearer refusal.** A token that was presented and refused is
  [MGS9001](MGS9001.md); the socket never reads one.
- **Not the loopback check.** A TCP peer off the loopback interface is
  [MGS9008](MGS9008.md).

## See also

- [The server's two transports](../../../guides/integrations/server.md#two-transports)