Aura-hosted MCP OAuth flow does not provide a refresh token for long-lived proxy clients #333

Summary

The OAuth flow for an Aura-hosted MCP endpoint completes successfully, but the resulting session does not include a refresh token. This means a long-lived MCP proxy such as Runlayer must ask the user to authenticate again whenever the access token expires.

Environment

• Endpoint: https://INSTANCE_ID.mcp-instances.neo4j.io (instance-specific hostname; the real instance ID is redacted here)
• Transport: Streamable HTTP
• Client/proxy: Runlayer
• Server: neo4j-mcp v2.0-alpha.1.7.3
• MCP protocol: 2025-11-25

Observed behavior

The initial browser-based OAuth flow succeeds. The MCP transport connects, initialization succeeds, and tools/list returns the expected tools.

A deep OAuth diagnostic then reports:

oauth_no_refresh_token
stored OAuth session has no refresh token; user will need to re-authenticate when access token expires

The protected-resource metadata identifies https://aura-mcp.eu.auth0.com as the authorization server. Its OpenID configuration advertises both the offline_access scope and the refresh_token grant.

Question / request

Can the Aura-hosted MCP OAuth flow issue a refresh token when a client requests offline_access?

If this is already supported, could you document the required scopes or client configuration? If it is not supported, please consider enabling refresh tokens for long-lived server-side MCP clients and proxies. The current flow works initially, but it cannot maintain unattended access after the access token expires.

It would also help to clarify whether repeated interactive authentication at session expiry is the intended behavior for hosted MCP integrations.

References

• Aura-hosted MCP documentation: https://neo4j.com/docs/mcp/current/mcp-for-aura/
• Aura MCP announcement and OAuth description: https://neo4j.com/blog/genai/introducing-mcp-for-aura/