• Where: MCP server detail page status badge (Click to Login) for a needs_auth tool.

• Steps to reproduce: Open a needs_auth MCP tool detail page, rapidly double-click Click to Login.

• What failed: Multiple OAuth windows can start from rapid repeated clicks; expected behavior is a single in-flight auth attempt.

• Code analysis: I reviewed the project-scope detail UI and OAuth login hook. The clickable status badge triggers handleOAuthLogin without any in-flight guard or disabled state, and the OAuth handler does not debounce/throttle repeated invocations before starting auth.

• Relevant code:

  agents-manage-ui/src/components/mcp-servers/view-mcp-server-details-project-scope.tsx (lines 101-118)

  {tool.status === 'needs_auth' ? (
    <Badge
      variant="outline"
      className="... cursor-pointer ..."
      onClick={(e) => {
        e.preventDefault();
        e.stopPropagation();
        handleOAuthLogin({
          toolId: tool.id,
          mcpServerUrl: tool.config.mcp.server.url,
          toolName: tool.name,

  agents-manage-ui/src/hooks/use-oauth-login.ts (lines 213-251)

  const handleOAuthLogin = useCallback(
    async ({ toolId, mcpServerUrl, toolName, thirdPartyConnectAccountUrl, credentialScope }) => {
      if (thirdPartyConnectAccountUrl) {
        await handleOAuthLoginManually(toolId, thirdPartyConnectAccountUrl);
        return;
      }
  
      const credentialStoresStatus = await listCredentialStores(tenantId, projectId);
      const isNangoReady = credentialStoresStatus.some(
        (store) => store.type === CredentialStoreType.nango && store.available
      );

  agents-manage-ui/src/hooks/use-oauth-login.ts (lines 239-245)

  if (isNangoReady) {
    await handleOAuthLoginWithNangoMCPGeneric({
      toolId,
      mcpServerUrl,
      toolName,
      credentialScope,
    });
  }

• Why this is likely a bug: The production click path starts OAuth without any single-flight protection, so rapid user input can deterministically launch duplicate concurrent auth attempts.

• Introduced by this PR: No - pre-existing bug (code not changed in this PR).

• Timestamp: 37:43

• Where: Same MCP detail reconnect control used for OAuth initiation.

• Steps to reproduce: On a needs_auth MCP tool, click Click to Login repeatedly (10+ times) before the first attempt settles.

• What failed: Many OAuth windows/tabs can be created concurrently; expected behavior is throttled or disabled initiation while one auth flow is active.

• Code analysis: The UI does not lock the reconnect control after first click, and the handler path repeatedly calls into auth start logic (handleOAuthLoginWithNangoMCPGeneric) with no per-tool mutex/debounce.

• Relevant code:

  agents-manage-ui/src/components/mcp-servers/view-mcp-server-details-project-scope.tsx (lines 102-117)

  <Badge
    variant="outline"
    className="... cursor-pointer ..."
    onClick={(e) => {
      e.preventDefault();
      e.stopPropagation();
      handleOAuthLogin({
        toolId: tool.id,
        mcpServerUrl: tool.config.mcp.server.url,

  agents-manage-ui/src/hooks/use-oauth-login.ts (lines 146-163)

  const handleOAuthLoginWithNangoMCPGeneric = useCallback(
    async ({ toolId, mcpServerUrl, toolName, credentialScope }) => {
      const authResult = await openNangoConnectHeadless({
        mcpServerUrl,
        providerUniqueKey: `${generateIdFromName(toolName)}_${toolId.slice(0, 4)}`,
        providerDisplayName: toolName,
      });

  agents-manage-ui/src/hooks/use-oauth-login.ts (lines 239-247)

  if (isNangoReady) {
    await handleOAuthLoginWithNangoMCPGeneric({
      toolId,
      mcpServerUrl,
      toolName,
      credentialScope,
    });
  }

• Why this is likely a bug: The reconnect path allows unbounded repeated invocations before completion, which is a production logic gap in idempotency/rate-limiting for auth initiation.

• Introduced by this PR: No - pre-existing bug (code not changed in this PR).

• Timestamp: 38:00

Screen Recording