Skip to content

fix: clean up OAuth tokens when deleting MCP server#14083

Open
xr843 wants to merge 3 commits intoCherryHQ:mainfrom
xr843:fix/cleanup-mcp-oauth-token
Open

fix: clean up OAuth tokens when deleting MCP server#14083
xr843 wants to merge 3 commits intoCherryHQ:mainfrom
xr843:fix/cleanup-mcp-oauth-token

Conversation

@xr843
Copy link
Copy Markdown
Contributor

@xr843 xr843 commented Apr 7, 2026

Summary

  • When deleting a MCP server, the corresponding OAuth token file ({serverUrlHash}_oauth.json) in ~/.cherrystudio/config/mcp/oauth/ is now automatically cleaned up
  • Prevents stale OAuth tokens from persisting after server removal, addressing the privacy/security risk
  • Only affects servers with baseUrl set (i.e., SSE/HTTP servers that use OAuth); silently skips if no token file exists

Fixes #14047

Test plan

  • Create an MCP server that requires OAuth authentication
  • Complete the OAuth flow to generate a token file
  • Verify the token file exists in ~/.cherrystudio/config/mcp/oauth/
  • Delete the MCP server
  • Verify the token file is removed from the oauth directory
  • Re-add the server and confirm OAuth flow is required again

🤖 Generated with Claude Code

When a MCP server is deleted, its OAuth token file remains in
~/.cherrystudio/config/mcp/oauth/, posing a privacy/security risk.
This adds cleanup of the corresponding OAuth token file during
server removal.

Fixes CherryHQ#14047

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@DeJeune DeJeune requested a review from vaayne April 8, 2026 09:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Delete MCP Server NOT clear oauth token

2 participants