MGS9030: too many failed authentications
The server answered 429 too many requests with a Retry-After header because
this caller had already failed authentication on /mcp more often than it
allows: 20 failures a second, in bursts of up to 40. The request would have been
refused anyway, for a missing token (MGS9011) or a refused one
(MGS9001); the message says which.
[MGS9030] this caller failed authentication more than 20 times a second (bursts
of 40); only failed attempts count, and a valid token is still admitted; this
request's bearer token was refused; retry after 50ms
see: .../MGS9030.md
Why
/mcp trusts its bearer token alone, so any web page can send it requests. The
limit keeps a page, or a client stuck retrying a dead token, from making the
server do unbounded work. A caller is its Origin header when it sends one,
which a page cannot change, and otherwise its peer address, so every local client
without an Origin shares one allowance.
Only refusals are counted. A request whose token verifies is admitted even while its caller is over the limit, and does not spend the allowance. A token whose grant is too small (MGS9015) is a valid token, so it is not counted either.
Resolution
Fix the credential rather than waiting: the throttle lifts within a second of
the failures stopping. Send a valid token with Authorization: Bearer <token>,
minting one if the old one expired or was revoked:
magus config mcp connector create --name my-client
A client that retries on a refused token should stop on 401 and honor
Retry-After on 429.