wooden-umbrella-84098
06/02/2026, 3:48 PMwooden-umbrella-84098
06/02/2026, 3:48 PMnutritious-balloon-65098
06/02/2026, 3:49 PMcalm-artist-7206
06/02/2026, 3:56 PMcalm-artist-7206
06/02/2026, 4:13 PMnutritious-balloon-65098
06/02/2026, 4:13 PMcalm-artist-7206
06/02/2026, 4:15 PMnutritious-balloon-65098
06/02/2026, 4:16 PMagent-canvas is stored in user settings under:
agent_settings.mcp_config
For Slack, the relevant saved shape is under something like:
agent_settings.mcp_config.mcpServers.slack.env.SLACK_BOT_TOKEN
agent_settings.mcp_config.mcpServers.slack.env.SLACK_TEAM_ID
Persistence paths found:
• Local agent-server: GET /api/settings and PATCH /api/settings
• Cloud: GET /api/v1/settings and POST /api/v1/settings
• UI reads from settings.agent_settings.mcp_config
• MCP add/update/delete writes via agent_settings_diff: { mcp_config: ... }
Likely cause of “randomly lost auth”:
• MCP saves use a two-step replace: first clear mcp_config to null, then write the new config. If the second write fails after the clear, the config/auth can be left empty.
• Another possible issue is redacted secrets: if the UI receives SLACK_BOT_TOKEN as "**********" and then round-trips that through an MCP edit/add/delete flow, it may overwrite the real token with the redacted placeholder.
No files were modified or committed.calm-artist-7206
06/02/2026, 4:31 PMcalm-artist-7206
06/02/2026, 4:31 PMnutritious-balloon-65098
06/02/2026, 4:31 PMnutritious-balloon-65098
06/02/2026, 4:32 PMsoftware-agent-sdk PRs by rbren.
Answer: the likely PR is OpenHands/software-agent-sdk#3187:
• Title: fix(settings): store MCP env/headers on disk instead of writing '<redacted>'
• URL: https://github.com/OpenHands/software-agent-sdk/pull/3187
• Author: rbren
• State: Merged
• Why it matters: it directly describes MCP env / headers credentials being persisted as literal "<redacted>", which would explain Slack MCP auth being lost.
Related follow-up:
• #3193: feat(settings): encrypt MCP env / headers with cipher at rest
https://github.com/OpenHands/software-agent-sdk/pull/3193
Also found related open follow-ups:
• #3234: typed settings update endpoints + ETag/If-Match
• #3235: per-server CRUD for MCP servers
No code changes were made.