Summary

• Moves the vendor/tinymcp gitlink from fe34f5b8c to 10786a472, delivering the fix for MCP server returning 401 is retried forever (18+ failures, every 300 s) with no needs-auth state in the UI #6412.
• Refreshes the tinymcp entry in scripts/ci/module-pin-exemptions.json, whose expect pins one exact drift and therefore has to move with the pin.
• No source changes in this repo. Two files, 3 insertions, 3 deletions.

Problem

An MCP server whose credential was rejected (HTTP 401) was retried forever: backoff grew to 300 s and stayed there, 18+ failures in one session, with no needs_auth state anywhere in the UI (#6412).

The fix landed upstream in tinyhumansai/tinymcp#20, merged 2026-09-22 as 10786a472. But vendor/tinymcp was still pinned at fe34f5b8c, whose tinymcp-side commit is dated 2026-09-19 — two commits behind the fix:

$ git ls-tree upstream/main vendor/tinymcp
160000 commit fe34f5b8c89a49e6f7ca05c2da791bb34550f85f	vendor/tinymcp

$ gh api repos/tinyhumansai/tinymcp/compare/10786a472...fe34f5b8c --jq '{status,behind_by}'
{"status":"behind","behind_by":2}

So the issue read as fixed while every build still shipped the old retry loop. A merged submodule PR is not delivery — the gitlink has to move.

Solution

The pin. vendor/tinymcp → 10786a472. The upstream change adds || error.is_unauthorized() to the terminal-error guard in crates/tinymcp/src/registry/supervisor/types.rs, so a 401 parks the server the way a missing runtime already did, instead of riding the backoff curve. Its own comment cites openhuman#6412.

The exemption. expect accepts one specific drift by design, so moving the pin widens it and fails check-module-pins.mjs until the new describe is recorded. v0.3.2-13-gfe34f5b8 → v0.3.2-15-g10786a47. The compile-only rationale is unchanged and still true: the registry retains the published v0.3.2 artifact, and tinymcp is registry-entered but not wired, so no build downloads or loads it. The reason text now also names the fix the drift carries.

What was verified, and how

Forward movement — checked two independent ways so a shallow clone could not fake it. gh api .../compare/fe34f5b8c...10786a472 → status: "ahead", ahead_by: 2, behind_by: 0. Locally, merge-base --is-ancestor confirms the same on a submodule verified non-shallow (rev-parse --is-shallow-repository → false).

Both gates, before and after:

The exemption edit was made only after the gate demanded it, not pre-emptively.

Two notes for anyone re-running these locally. Both gates need submodules checked out — the pin gate fails closed with "vendor/tinydocs is not a checked-out submodule" rather than skipping. And the monotonic gate reads committed gitlinks (ls-tree of base..HEAD), so run before committing it reports none moved and exit 0 — a false green indistinguishable from a real pass. It also defaults to origin/main, which on a fork is stale; the runs above pass upstream/main explicitly.

Cargo.lock does not move — verified rather than assumed, two ways: git status --porcelain Cargo.lock is empty, and the upstream diff touches zero Cargo manifests.

Contract compile. cargo check -p openhuman --lib passes on this branch — exit 0, zero errors, 307 dependency crates including tinymcp v0.3.2 and tinymcp-bus v0.3.2 at the new pin. To be sure the host lib itself was exercised and not just its dependencies, I forced it to rebuild (touch crates/openhuman-core/src/lib.rs) and confirmed Checking openhuman v0.63.31 ... Finished in 11.27s with no errors. The 8 warnings are pre-existing dead-code warnings in vendored tinyjuice, unrelated to this change.

Note the package is openhuman, not openhuman-core — the directory name differs from the crate name. Reaching a compile also required all 16 top-level submodules plus vendor/tinyagents' nested tinyinference / tinytools / wiki; two earlier exit 101s were dependency resolution failures, not compilation.

Submission Checklist

• Tests added or updated — N/A: submodule pin bump; the behaviour change and its tests live in tinymcp#20, which adds 70 lines of supervisor tests. No openhuman source changes to test.
• Diff coverage ≥ 80% — N/A: no executable lines changed in this repo. The diff is one gitlink and one JSON metadata field.
• Coverage matrix updated — N/A: behaviour-only change, delivered from a submodule; no feature rows added, removed or renamed.
• All affected feature IDs from the matrix are listed under ## Related — N/A: no matrix rows affected.
• No new external network dependencies introduced — no new dependency; an existing vendored submodule moves forward two commits.
• Manual smoke checklist updated if this touches release-cut surfaces — N/A: no release-cut surface changed. tinymcp is registry-entered but not wired, so no build downloads or loads the artifact.
• Linked issue closed via Closes #NNN in the ## Related section — see below.

Impact

Desktop runtime. An MCP server that returns 401 now stops being retried instead of issuing a request every 300 s for the life of the session, which removes the log and Sentry noise reported in #6412 and stops the pointless traffic against a third-party endpoint.

Scope is bounded: the change is internal to tinymcp's reconnect supervisor, adds no public signature change to Supervisor::tick or TickReport, and this repo's sources are untouched.

Not covered by this PR: the needs_auth state in the MCP Servers page and the "Set token" action, which are the UI half of #6412's acceptance criteria. Those remain open — this delivers the retry-halting half.

Related

• Closes: MCP server returning 401 is retried forever (18+ failures, every 300 s) with no needs-auth state in the UI #6412
• Upstream: Park a server whose credential was rejected instead of retrying it forever tinymcp#20 (10786a472)
• Follow-up PR(s)/TODOs: needs_auth UI state + "Set token" action for the MCP Servers page. Also mcp_setup_request_secret never renders a prompt — times out 120 s ×3, agent asks for the bearer token in plain chat #6411 and MCP registry search hangs 15 s against registry.modelcontextprotocol.io and fails with no error shown #6415, which are tinymcp-side and gated on the same pin.

AI Authored PR Metadata (required for Codex/Linear PRs)

Linear Issue

• Key: N/A
• URL: N/A

Commit & Branch

• Branch: fix/bump-tinymcp-6412
• Commit SHA: 0fa8353950c732921e26c6ca391416744405c66f

Validation Run

• pnpm --filter openhuman-app format:check — N/A: no app/ files changed.
• pnpm typecheck — N/A: no TypeScript changed.
• Focused tests: node scripts/ci/check-module-pins.mjs and node scripts/ci/check-submodule-monotonic.mjs upstream/main HEAD — both exit 0 post-commit; outputs in the table above.
• Rust fmt/check (if changed): cargo check -p openhuman --lib → exit 0, zero errors (forced-rebuild confirmation of the host lib included above). N/A for fmt: no Rust sources changed in this repo.
• Tauri fmt/check (if changed): N/A: no Tauri sources changed.

Validation Blocked

• command: none blocked.
• error: n/a
• impact: n/a — the two pin gates and the contract compile all ran and passed. Not attempted: the full test suite and clippy, neither of which this diff can affect (no Rust, TypeScript or workflow sources changed).

Behavior Changes

• Intended behavior change: an MCP server returning 401/403 is parked as terminal instead of retried on the backoff curve.
• User-visible effect: the repeating reconnecting failed: mcp unauthorized ... retry_in_seconds=300 warnings stop. The MCP Servers page still shows no needs_auth indicator — that half of MCP server returning 401 is retried forever (18+ failures, every 300 s) with no needs-auth state in the UI #6412 is not addressed here.

Parity Contract

• Legacy behavior preserved: yes for every other error class. Only the unauthorized case changes branch; is_missing_runtime() already took this exact path, and the new condition is OR'd onto it.
• Guard/fallback/dispatch parity checks: check-module-pins.mjs and check-submodule-monotonic.mjs both pass post-commit against upstream/main.

Duplicate / Superseded PR Handling

• Duplicate PR(s): none — no open PR on this repo touches vendor/tinymcp.
• Canonical PR: this one.
• Resolution: N/A

Summary by CodeRabbit

• Bug Fixes
  • Servers whose credentials are rejected are now parked instead of retrying indefinitely, preventing repeated connection attempts. Restart or update the server’s credentials to resume connections.