# Fix AI agent connection problems

> Fixes for agents that can only read, ask you to sign in again, can't find a workspace, or stop at the sign-in step when connecting to Wavefront over MCP.

Source: https://wavefront.adwave.com/help/troubleshooting/agent-connection-problems (updated 2026-10-14)

Most agent connection problems come from the access granted on Wavefront's consent page, the connection's 30-day lifetime, or the role of the person who connected. Reconnecting with **read**, **write** and **stay connected** checked fixes most of them. The full setup for each client is in the [MCP guide](/docs/mcp).

## The agent can read but not draft or publish

**Cause.** The connection was granted read access only. Write tools answer `403 insufficient_scope`.

**Fix.** Ask the agent to call `wavefront_whoami`: it says what the connection can do and how to fix it. Then open **Account → Connected agents** in Wavefront, choose **Disconnect** for that agent, and connect it again with **write** checked on the consent page.

If write is granted and the agent still can't write, check your role on the workspace's **Team** page. A viewer's connection can only read, whatever it was granted. Ask an owner to make you an editor.

## The agent asks you to sign in again

**Cause.** A connection lasts 30 days from when you chose **Allow**, however often it's used. After that, the client must sign in again.

**Fix.** Sign in when the agent asks. This is expected about once a month. Leave **stay connected** checked so the connection lasts the full 30 days.

## The agent can't find a workspace

**Cause.** The connection sees only the workspaces the person who connected belongs to. You may have used a different email, or not accepted an invitation yet.

**Fix.**

1. Ask the agent to list your Wavefront workspaces, and use the slug from that list.
2. If the workspace isn't there, open Wavefront in your browser and check you're signed in with the same email. Accept any pending invitation on **Account**.
3. If you were removed from the workspace, ask an owner to invite you again.

## The agent stops at a 401 from the MCP address

**Cause.** A `401` is how clients discover the sign-in. A client that stops there doesn't support OAuth.

**Fix.** Use a client that supports remote MCP with OAuth, or the `mcp-remote` bridge described in the [MCP guide](/docs/mcp). For a bot that can only send a fixed header, an owner can create a workspace API key instead.

## Allow does nothing, or the browser doesn't return to the app

- Allow pop-ups from the agent's site. Grok, for example, opens the sign-in in a pop-up.
- The **Allow** and **Deny** buttons lock after the first click, because an approval can be used once. If nothing happens, start the connection again from the agent.
- In Cursor, choose **Needs login** next to the server to start the sign-in in your browser.
- If it still fails, email support@adwave.com with the client's name and the address it tried to return to.

## The agent says it can't approve, withdraw or post

**Cause.** These actions are reserved for people in the web app: approving a version, withdrawing a post, posting to social networks, sending newsletters, turning auto-approve on, team and billing changes.

**Fix.** Do them in the web app. The agent can still draft, revise, comment and publish work that's already approved. See [signing in and roles](/help/account-and-team/sign-in-and-roles).

## The agent says a plan is needed

**Cause.** The workspace's trial ended without a plan. The MCP server answers `402 plan_required`.

**Fix.** An owner chooses a plan on **Billing**. See [your plan and credits](/help/billing-and-credits/plan-and-credits).

## Errors from tools

Tool errors read `Error <code>: <message>`, often with a `Fix:` line saying what to do. The codes are listed in the [errors reference](/docs/errors). A `conflict` usually means something changed meanwhile, such as the plan or a strategist reply still running: read the current state and try again.

## Connected with an API key

If the agent connects with a workspace API key instead of signing in:

- A `401` means the key is wrong or revoked.
- A `403 insufficient_scope` means the key lacks a scope. A key needs `generations:read` to connect at all, and a write scope to draft or publish. An owner creates a key with the right scopes under **Settings → API and MCP**.
- Some tools, such as commenting as a person, need a signed-in connection instead of a key.

## Still stuck

Email support@adwave.com with the client you use, the time, and the exact error.

---

Wavefront by Adwave. https://wavefront.adwave.com/