Local AI Automation and Permissions AI assistant · Q&A

Fix an “Invalid token” MCP response

Verify the current token, environment variable, and caller process without exposing credentials in logs.

Updated Aug 24, 2026

This response means the bearer token sent by the caller does not match the token currently accepted by MaskPilot.

Fix it

  1. Copy the current MCP token from the MaskPilot client.
  2. Update the MASKPILOT_MCP_TOKEN environment variable.
  3. Fully restart or reload the caller so it reads the new value.
  4. Connect to MCP again.

If the token appeared in a public log, screenshot, or repository, rotate it in the client immediately and then update the caller.

Do not place the token directly in a configuration file that can be committed. Prefer bearer_token_env_var and an environment variable.

In this topic

These pages cover the same product capability as the current article.
Guide Connect local MCP to Codex Guide Manage AI Permissions and Tokens Q&A Fix a Local MCP Connection Refused Error Q&A What does “Unknown tool” mean in MCP?