CLI cannot use fresh token in MCP OAuth

[daniel-zelazny]

What happened?

My MCP server requires authorized access, so I configured the appropriate metadata files and enabled the Authorization Code Flow to obtain access tokens. The authorization server and pre-registered client are set up to issue expiring access tokens along with refresh tokens. This setup works correctly with other clients.

However, I am experiencing unexpected behavior:

Communication with the MCP server fails once the access token expires.

Even after running /mcp auth mymcp, I can see a new token in ~/.gemini/mcp-oauth-tokens.json, but requests continue to use the old (expired) token.

In some cases, running /mcp auth mymcp followed by /mcp refresh results in the new token being used. However, I have not identified any clear pattern - the behavior appears non-deterministic.

Closing the Gemini CLI and restarting it resolves the issue temporarily. The fresh token is then used correctly until it expires again.

What did you expect to happen?

I expect the client will ask for new access token with refresh token when it expires and use the fresh token in requesting MCP server.

Client information

Client Information

Run gemini to enter the interactive CLI, then run the /about command.

> /about
CLI Version:  0.28.2
GIT Commit: da5e47ae3
Model: auto-gemini-2.5
Sandbox: no sandbox
OS: linux
Auth Method: Logged in with Google (****)

Login information

Google Account

Anything else we need to know?

No response

[Atul-Chahar]

/assign

[gemini-cli]

👋 @Atul-Chahar, you've been assigned to this issue! Thank you for taking the time to contribute. Make sure to check out our contributing guidelines.

[ravencore06]

/assign

[gemini-cli]

@ravencore06 Thanks for taking interest but this issue is already assigned. We'd still love to have you contribute. Check out our Help Wanted list for issues where we need some extra attention.