Troubleshooting

The most common failure modes and their fixes.

401 from /mcp

• Check the header is exactly Authorization: Bearer tg_... with the full key, not just the prefix shown in the key list.
• The key may be revoked or expired: the Keys page shows each key's state and when it was last used. Mint a new one if in doubt.
• OAuth access tokens live 15 minutes; a client that cannot refresh (for example after you revoked its grant) must reconnect. Check Settings, Connected agents.
• The 401 response itself carries a WWW-Authenticate header pointing at the discovery document, which is what lets OAuth-capable clients recover on their own.

A tool is not listed

• If the agent is connected to a bundle URL, it sees only that bundle's assigned tools. Check the bundle's tool assignment, or point the agent at the main workspace URL.
• Tools from an external MCP server disappear while the server is disabled or in an error state; check the MCP servers page and rerun discovery.
• A tool created by a build is only listed once the build finished successfully; check the build's page for its state.

Every request against a connection 404s

• The connector's base URL or path prefix is probably wrong, the most common issue with a freshly drafted connector. On the connection's detail page use Fix with AI (it gathers the recent failures itself) or Edit definition to correct the JSON; your connections pick up the fix automatically. Retest in the Playground.
• Probing helps: run the connector's known-good test request from the Playground's ad-hoc bench, then walk the path segments until the 404 turns into a real answer.

An agent's tool-creating call was denied

That is the workspace tool policy doing its job: by default agents need a human-opened window before they may create, rebuild, or delete tools. Open one under Settings, Agent tool changes (it closes by itself), or set the policy to Open for unrestricted agent building. The denial message the agent saw says exactly this.

A build failed

The unused part of the hold was refunded automatically; the ledger shows both the hold and the settlement. Open the build page to see each iteration and what the tests returned, then rebuild with feedback describing what you expected. Builds also require a connection that allows build testing, and enough balance to cover the reservation.

A connection shows Disconnected

The vendor stopped accepting our token, usually because it was revoked on the vendor side or expired without a refresh token. Open the connection's detail page and use Reconnect (OAuth) or enter new credentials. Runs against a Disconnected connection are denied without charge.

A run was denied

Denied runs are recorded with the reason and cost nothing. The usual causes are insufficient balance (top up on Billing), a missing scope on the agent's key or grant (the error names the scope), or input that failed the tool's schema.

Auto top-up turned itself off

Three failed charges disable it automatically and email the workspace owners. Update the card on the Billing page and re-enable it; that resets the failure counter.