Tools
MCP Inspector puts a 30-second deadline on every OAuth-path request, covering the body and not just the headers
PR #2324, merged 2026-09-11, adds `withOAuthRequestTimeout` with `DEFAULT_OAUTH_REQUEST_TIMEOUT_MS = 30_000`, wrapping fetch so headers and body are both bounded, since fetch resolves as soon as headers arrive and a server that stalls afterwards would hang the caller's `response.json()`. Errors now name the endpoint instead of reporting a bare "Request timed out" blamed on the handshake. Both the OAuth and transport fetch chains carry the deadline; the transport chain exempts MCP traffic by content type first, so a form-encoded token refresh is never exempt even when `oauthTokenUrl` points at the MCP endpoint's own URL.
Source
↳ Follow the thread