# Troubleshooting {#troubleshooting}


Start from the client you added, then from **Your account → AI access**. This page does not cover host setup. If the account card says AI access is not enabled, an operator has to enable it. A client retry will not.


## The browser never opens {#the-browser-never-opens}


For Codex CLI, the intended command is `codex mcp login elova`. For Claude Code, the intended control is `/mcp`. These flows are pending installed-client acceptance on the published service. A missing browser does not prove the catalog is deployed.

Use the address shown under **AI access**, or `https://mcp.elova.dev/mcp` for the published service. Do not add an API key.

Claude Desktop, Cowork, and claude.ai connectors are not supported.


## The connection page says the request is invalid or expired {#the-connection-page-says-the-request-is-invalid-or-expired}


The sign-in request is short-lived. Close it and start sign-in from the client again. Do not reuse an old browser tab.

Approval also requires a fresh password sign-in, normally within five minutes. If the page asks you to sign in again, do that before allowing access.


## Allow stays unavailable {#allow-stays-unavailable}


You need at least one eligible workspace. If the page says to ask a workspace administrator for an invitation, this account has no workspace to approve.

You must also select 1–50 workspaces, at least one read permission, and the sharing acknowledgement.


## The client authenticates, then a tool is forbidden {#the-client-authenticates-then-a-tool-is-forbidden}


Check **Connected clients**:

- the workspace is listed
- the required scope is listed
- the expiry is still in the future

`workspaces:read` is required for workspace tools. `n8n:read` is required for instance, workflow, execution, statistics, and sync-job tools. A missing scope is rejected before the read. The HTTP challenge can include `insufficient_scope` and the scope name.

A platform administrator role does not add workspace access.


## Removal asks for a fresh sign-in {#removal-asks-for-a-fresh-sign-in}


**Remove access** requires a password sign-in from the last five minutes. Sign in again, reopen **Your account → AI access**, and confirm removal.

Signing out of the browser does not remove the connection. Completing a password reset, a forced sign-out, or a login-email change does invalidate earlier approvals. Reconnect from the client after those changes.


## The tool list is empty or has unknown names {#the-tool-list-is-empty-or-has-unknown-names}


Refresh or reconnect so the client requests the tool list from the server it is connected to. A refresh does not deploy a newer catalog, and it does not require a new approval if the current approval is still valid.

The repository catalog accepts only these names, with no aliases:

`get_many_workspaces`, `get_workspace`, `get_many_instances`, `get_execution_stats`, `get_many_sync_jobs`, `get_many_executions`, `get_execution`, `get_many_workflows`, `get_workflow`.

If the published service has not accepted that catalog, the client can still list the earlier names after a refresh.


## The client reports an input validation error {#the-client-reports-an-input-validation-error}


The SDK checks arguments before the read. That message is not one of the fixed backend codes. Correct the arguments and retry.

A local call with `limit: 51` on `get_many_workspaces` returned:

```text
Input validation error: Invalid arguments for tool get_many_workspaces: limit: Too big: expected number to be <=50
```

Unknown fields, bad enums, and IDs that are not UUIDs fail the same way. `limit` must be an integer from 1 to 50.


## A read returns a fixed error code {#a-read-returns-a-fixed-error-code}


After the arguments pass the schema, a failed read returns a fixed code. The text does not include the underlying record.

| Code | What to do |
| --- | --- |
| `UNAUTHENTICATED` | Start sign-in from the client again |
| `FORBIDDEN` | The approval was removed, expired, or no longer matches this account. Reconnect |
| `NOT_FOUND` | The local ID is outside this approval, or the selected workspace is no longer granted. List again and use a returned UUID. Discard any cursor |
| `VALIDATION_ERROR` | The cursor binding failed. The eligible workspace set, account, approval generation, filters, or page size no longer match, or the cursor was tampered with. Discard it and start again without one |
| `MCP_CURSOR_STALE` | The retained snapshot or source changed. The text is `MCP_CURSOR_STALE: Read settings changed. Restart without a cursor.` |
| `MCP_OUTPUT_INVALID` | The retained result could not be returned inside the tool contract. Narrow the page or try another record |
| `MCP_BACKEND_UNAVAILABLE` | Retry later. The read service did not complete |
| `RATE_LIMITED` | Wait for `Retry-After`, then retry the same read |

HTTP 401 means the bearer token is missing or invalid. HTTP 403 before a tool runs can mean the token lacks that tool's scope. HTTP 429 means a concurrency or per-approval rate limit. HTTP 413 means the request body exceeded 32 KiB.


## The answer looks incomplete {#the-answer-looks-incomplete}


Check the flags before you treat a page as the whole history:

- `coverage.partial` is always true
- `coverage.workflowsTruncated` or `coverage.executionsTruncated`
- `nextCursor`
- `truncated` on sync jobs
- `nameTruncated` or `workflowNameTruncated`
- `nodesTruncated`
- `history.truncated`, or `history.availability` of `partial`, `unavailable`, or `expired`

On an execution row, `cost` may be absent or `null`. Neither means the run was free. Statistics always include `cost`, and that value may be `null`. `usage: null` on statistics means aggregate usage is not available.

`get_execution_stats` cannot identify the newest execution. Call `get_many_executions` with `limit: 1`.


## The client offers to change n8n {#the-client-offers-to-change-n8n}


Decline that action. The repository catalog cannot run a workflow, edit a node, start a sync, or create a workspace. Ask for a read with a tool the connected server actually lists.