[bug] Railway OAuth refresh fails with invalid_scope: refresh token missing requested scope

[mmarabel]

Executor version

Executor Cloud; deployed server version not exposed in the captured response. No local Executor CLI or desktop app involved.

How do you run Executor?

Executor Cloud, accessed over MCP from the Pi coding-agent client on Linux.

Integration involved

Railway MCP (railway_mcp), existing saved OAuth connection.

What happened

A read-only list_projects({}) call fails when Executor attempts to resolve/refresh the saved Railway OAuth connection. Railway rejects the refresh with HTTP 400 invalid_scope: "refresh token missing requested scope". Executor reports oauth_refresh_failed and retryable: false.

Tool discovery and schema inspection worked, but invoking the tool failed before it could list projects. This blocks access through the saved integration.

The account owner reports this has happened repeatedly. This report includes one directly captured failure from September 9, 2026; we do not have historical server logs establishing frequency or whether earlier failures had the same cause. We have not yet reauthorized the connection, so this is not a claim that reauthorization fails to fix it.

What you expected

The saved Railway connection should refresh successfully using its granted scopes. If new scopes require fresh consent, Executor should clearly mark the connection as requiring reauthorization and provide an actionable reconnect flow rather than leaving a seemingly available integration unusable at invocation time.

Steps to reproduce

1. Use an existing saved Railway MCP OAuth connection in Executor Cloud.
2. Discover the Railway list_projects tool and inspect its schema ({}).
3. Invoke it through Executor execute:

// <connection> is a placeholder for the existing saved connection name.
const result = await tools.railway_mcp.user.<connection>.list_projects({});

4. Observe the refresh error below instead of a project listing.

The exact connection age, original granted scopes and scope set in the refresh request are unknown; maintainers may need those server-side details to reproduce.

Diagnostics / logs

Captured client-visible tool result, with the saved connection identifier redacted:

{
  "code": "oauth_refresh_failed",
  "message": "OAuth connection \"railway_mcp.user.<connection>\" could not be resolved: OAuth token refresh was rejected (invalid_scope): OAuth token exchange failed: refresh token missing requested scope (HTTP 400 Bad Request from backboard.railway.com; content-type application/json; charset=utf-8)",
  "retryable": false,
  "details": {
    "category": "authentication",
    "credential": {
      "kind": "oauth",
      "label": "railway_mcp.user.<connection>"
    },
    "upstream": {
      "details": {
        "oauthErrorCode": "invalid_scope"
      }
    }
  }
}

The response also included generic recovery guidance pointing to executor.coreTools.oauth.start. That guidance is not evidence of a completed reconnect attempt.

This is the tool response, not an Executor internal log export. No access token, refresh token, authorization header, workspace URL or business data is included.

Investigation questions

• Does the refresh request include scopes beyond those originally granted to this saved connection?
• Has the Railway integration's scope configuration changed in a way that invalidates existing grants?
• Can scope-mismatch failures transition the connection into a visible reconnect-required state?

Scope drift is a hypothesis suggested by the upstream error, not a confirmed root cause; we cannot determine from this response whether the mismatch originates in Executor's request, the saved grant or Railway's validation.

Before you submit

• Searched existing issues for Railway and invalid_scope; no matching Railway report found.
• Removed all keys, tokens and credentials from this report.