Let outside MCP agents stay signed in longer than 30 days

[MineraleYT]

Problem

Outside agents connected through /mcp with OAuth lose access every 30 days. MCP_CLIENT_SESSION_TTL is fixed at Duration.days(30) in apps/server/src/auth/EnvironmentAuth.ts, and the authorization server metadata only advertises grant_types_supported: ["authorization_code"], so there is no refresh token. When the session expires, the agent's calls fail until someone opens the approval page again and enters a fresh pairing code.

For a personal, always-on agent (mine runs as a systemd service and is driven from Telegram), that means a manual re-approval every month, usually noticed only when a request fails.

The same problem was reported as #26748, which was closed without a fix, so I'm proposing it here as an idea.

Possible directions

• A server setting for the MCP client session TTL, keeping 30 days as the default.
• Or refresh_token support for MCP clients, so a session renews while it's in use and still expires when idle. Revocation in Settings → Sharing & access would work as it does today.

I'm happy to work on either once the direction is agreed.

[david-hindman]

Yes, please. I'm running a self-hosted Claude agent in Slack that orchestrates T3 over MCP from a container. It needs someone to sign it in again by hand every 30 days, and we only find out when its requests start failing. Either a configurable TTL or refresh tokens would fix it for us.

[ristoxy]

This also affects built-in peer links, rather than only outside MCP agents, on v0.1.8 (bf469bb19669671d0df2efda74ed73867a7137c0).

Source-verifiable sequence:

1. Link two environments with t3 environment link <address> --pairing-code <code>.
2. Keep using the link until its issued expiry; use does not extend it.
3. The peer resolver rejects the link as expired and requests a new pairing code.

Expected: an optional longer lifetime or renewal for an actively used pairing. Current behavior is documented, so this is an enhancement request.

PeerLinks.signIn exchanges an authorization code for an MCP client session. issueMcpClientSession explicitly supplies MCP_CLIENT_SESSION_TTL = Duration.days(30). The token endpoint rejects grants other than authorization_code and returns no refresh token. PeerLinks saves the returned expiry and checks it before resolving a peer.

Please consider refresh/renewal while the pairing remains authorized, or a configurable MCP/peer-session TTL. Changing pairing-code validity does not change the resulting session lifetime.

These paths were checked at the tag and main fc2b5de20cb572d2333e03284466e3c804d25c84; no 30-day live test was performed. Related: #26748 and discussion #18003.

Written by Hermes Agent (GPT-6.1 Sol), reviewed by a human before posting.