When a connector breaks
Every sentence MaShop can give you when a connection stops, what it means, and what to do when a tool is refused during a run.
Fix a problem
A connector is an outside account your agents reach, and each of its tools carries one permission: Off, Ask or Allow.
What you see is one of four things. The connection stops with a sentence. The card stays on waiting. A tool is refused during a run. Or the permissions you set are back on their defaults.
The connection stops with a sentence
MaShop names a closed list of causes. Each sentence maps to one gesture.
| What you read | What to do |
|---|---|
| This is not a valid URL. Check that it starts with https:// | Copy the address again from the publisher documentation. |
| Only https:// addresses are accepted. | An unencrypted address is refused. Ask the publisher for the secure one. |
| Remove the username and the password from the address. | Credentials never travel in the address. Keep the host and the path only. |
| This address leads to an internal network. | Only a publicly reachable server can be connected. |
| This service redirects to an unencrypted address. | The connection was stopped on purpose. Report the redirect to the publisher. |
| This service redirects an authenticated request to another domain. | Stopped so your credentials are not sent there. Use the address the publisher owns. |
| This server did not respond. | The service is down or the address is wrong. Try later, then contact the publisher. |
| The server answered a status. This is not an MCP entry point. | You reached the site, not the MCP endpoint. Look for the MCP address in the documentation. |
| The authorization metadata of this server cannot be found. | The server does not publish what MaShop needs to start the consent. Only the publisher can fix it. |
| The authority of this server does not expose its metadata. | Same case, on the authorization side. |
| The authority of this server does not advertise PKCE S256. | The connection would be less safe than the specification requires, so it is refused. |
| This server requires no authorization. There is nothing to connect. | Nothing is broken. That server has no account to attach. |
| This server names no authority to issue a token. | No token can be obtained. Only the publisher can fix it. |
The card stays on waiting
The line is written before you leave for the provider. If you refuse there, or your session expires during the detour, the card can stay on Waiting for your approval on the service. Press Cancel on that card, then start again.
Only the owner can connect or remove an access. Editors and viewers read the list.
The return link is single use, lasts 10 minutes, and must be opened by the person who started the connection.
A tool is refused during a run
- No executor is wired for that tool. MaShop executes two today, reading Supabase data and saving an email draft, so setting one of the others to Allow authorizes nothing that can actually run.
- Tools from a connected MCP server are relayed to that server and do run, under the same permission gate as the rest. A reply is capped at 20 seconds and 4 000 characters.
- The agent forbids it in its own sheet. That list is the only per agent filter: a server connected to the project is connected for every agent of that project.
The permissions are not the ones you set
The permissions window reopens on its defaults: reading on Allow, everything else on Ask. It never reads back what was saved, so what it shows is not always what applies. Set what you need again before closing it.
Permissions are stored under the bare tool name, for the whole project. Two connectors exposing the same tool name share one setting. The name domain.verify exists at Vercel and at Resend, so turning it off for one turns it off for both.
Allow is stronger than the autonomy level. A tool on Allow runs even when the agent is set to prepare and wait for your signature.
Turning the switch back on
Off is immediate: the tokens are erased and the line is revoked. On is a full consent again at the provider, because only the provider issues a new token.
One live connector of a given kind per project, and one live server per address. A revoked address can be connected again. Servers listed in the public registry are published by their authors and verified by nobody.
Revoke the access in the provider account as well
Disconnecting removes the access on the MaShop side only. The token stays valid at the provider until you revoke it there yourself.