When remote MCP tools work on day one and disappear on day two, the access token has usually expired and the client couldn't refresh it. Either no refresh token was issued, the refresh token itself expired or was revoked, or rotation sent the client a new refresh token it didn't store. The client then asks you to authenticate again. The fix is mostly on the authorization server (AS): issue refresh tokens to MCP clients, set lifetimes that fit how often people actually use the tool, and handle rotation cleanly.
Symptom card
- Tools were listed yesterday. Today they're missing, or the server shows as needing auth.
- Server logs show 401s on expired tokens with no successful refresh before them.
- Reconnecting fixes it until the next expiry.
Token lifetime basics
- Access tokens are short-lived on purpose. Their expiry isn't a bug.
- Refresh tokens let the client get a new access token without another browser login. Whether one gets issued depends on your AS config, and some servers need a scope such as `offline_access` before they'll issue one.
- Refresh token lifetime caps how long the session can go without a fresh login. Absolute and idle limits both count.
Rotation and revocation pitfalls
- With rotation, every refresh returns a new refresh token and invalidates the old one. If two client processes refresh at the same time, one can end up holding a dead token.
- Reuse detection on some servers revokes the whole token family after one stale reuse.
- Password changes or admin revocation end every session. That's expected, but it looks the same as this bug.
Check your AS docs for the exact behavior instead of assuming it.
Reconnecting in the client
Cursor and Claude each have their own way to re-authenticate an MCP server. Follow the current Cursor docs and Claude's help pages instead of the UI steps in an old post. After you reconnect, confirm `tools/list` returns again, then watch the next expiry window in your server logs.
Debugging refresh failures
Log every token-endpoint response on the AS side, with secrets redacted. A failed `grant_type=refresh_token` call names the cause (`invalid_grant`, an expired token, or a revoked one). MCP Inspector is useful for re-running the initial flow, and the failure card covers the challenge-side breakages.
Where the kit fits
The MCP Starter Kit ($27) is built for remote MCP sessions that have to survive more than one day of use in Cursor and Claude Connect. Soft path: start at /free; Cheat Sheet for the skim checklist mindset; kit when you want the auth-ready layout.
Soft next step
Confirm your AS issues refresh tokens to the MCP client, then log one full expiry-and-refresh cycle. Soft ladder: /free, then the MCP Starter Kit ($27). Related: OAuth pillar.