Safety and Troubleshooting

Security boundaries

• Provider tokens and custom OAuth secrets stay in the Gateway credential store. They do not enter project files, browser storage, SQLite, or logs.
• A connected account grants provider access. It does not grant blanket task access. Turn the Connector on for the task that needs it.
• Writes resolve to one account and retain action-specific confirmation.
• Custom MCP tools default off and require confirmation each time.
• Brokerage orders require account resolution, preview, fresh confirmation, revalidation, and a receipt. Background tasks and sub-agents cannot submit orders.

Connection window closes without success

Return to the permission dialog and check for an error. Minara ends the loading state when the OAuth window closes, the callback expires, or the provider rejects access.

Try these checks:

1. Allow pop-ups for the Minara site.
2. Complete sign-in in the same browser profile.
3. Confirm the callback reached the current Gateway.
4. Retry from Manage connector.
5. If the button is disabled, read the availability reason in the detail view.

Do not repeat sign-in while an earlier authorization window is still active.

Connect is unavailable

The current build may lack a required provider connection, a Provider may still be approving the integration, or a Preview MCP service may not be enabled. The detail dialog shows the reason. Minara does not create an OAuth state or open a window for an unavailable Connector.

Permission denied after connection

Check the service level and selected account. Read cannot perform writes. An account with expired or revoked access needs reconnection. If permissions were lowered, Minara blocks the action immediately. Reconnect to remove old scopes at the provider.

MCP tool missing

Built-in office Connectors choose their action route during preflight. A REST route is used only when the MCP tool was absent and the built-in adapter covers that action. Runtime timeout, 401, 429, 5xx, schema drift, or an unknown result does not switch routes.

Custom MCP and brokerage Connectors have no REST route. Fix the MCP server or its authorization, then retry.

Paid MCP returns payment required

Open the returned x402 charge and verify that it offers exact, canonical USDC, and an EVM or Solana network. Unsupported schemes and assets are not converted into a generic wallet transfer. After a successful payment, retry the identical MCP call once.

If a direct connection exposes no challenge_id, the server may be returning an invalid 402 response. If the Connector uses a hosted broker, confirm that the broker forwards the x402 headers. When payment status is uncertain, check it before retrying; never create a second payment for the same unknown result.

Cloud file conflict

Drive and OneDrive updates use provider version checks such as eTag. Refresh the file and review the newer version. Minara does not silently overwrite a conflicting cloud edit.

Cloud publishing fails

With Connector first delivery, Minara verifies a canonical local artifact before publishing. The local file remains available after a cloud failure. Retry publishing after the account or destination is fixed.

Order result is unknown

Do not submit the same order again. Minara first reconciles the local intent ID with the provider order state. It requests another confirmation if a material field, estimated cost, account state, or preview changes.

Broker snapshots do not support tax, accounting, TWR, XIRR, or audit-grade historical claims. Export records from the broker or custodian for those tasks.