> This page is for Tools. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.moveworks.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.moveworks.com/_mcp/server. # Troubleshooting > **Controlled Availability** > > MCP Workspace is available to a limited set of customers. Moveworks is validating the experience and gathering feedback, so capabilities and limits may change. To request access, [register your interest](https://community.moveworks.com/p/mcp-workspace-controlled-availability). When an MCP request fails or returns the wrong result, first check what the assistant did. Then work through the four stages of a request in order. The first stage that fails is where to focus. Some behavior is a current limit rather than a failure, such as MCP tools running only in the Universal Assistant. [Requirements and Limits](/tool-studio/mcp-workspace/requirements-and-limits) lists those limits. ## Check What the Assistant Did Start by identifying whether the assistant selected the expected MCP tool and what happened next. * **Reveal AI Reasoning**: In the assistant, open **More info > Reveal AI Reasoning** on a response. This is the fastest first check for a user. * **Chat Playback**: Admins can review the available and selected tools for a conversation. A conversation can take roughly 10 minutes to appear. * **MCP tool call logs**: Open the **Logs** app to inspect the arguments, model-visible response, execution status, latency, and error for each call. [Find the MCP Tool Call Log](#find-the-mcp-tool-call-log) explains the filters. There is no dedicated MCP analytics dashboard. MCP tool calls use the format `mcp____`. If you expected that prefix but see a plugin or `Enterprise_Search` instead, focus on tool selection. ![Assistant response with the More info button highlighted.](/_fern-img/4f961e314b34e768244c9a137ca6bc61aa359838a1e074c7113ec39c74b4a8f8.webp)![Reveal AI Reasoning panel showing an MCP tool call with an mcp\_\_ prefix.](/_fern-img/e7f110edeb1672ff3a8e2105e8934af9a2b739f7804a9bf5f025e859720c08ec.webp)![Chat Playback page showing a conversation and the plugin selection panel.](/_fern-img/ab77671293f7ede6b0cf6127cc16906a4505edd75117df0aaf333bc455dedb03.webp) ### Find the MCP Tool Call Log Every MCP tool call creates a log entry in the **Logs** app. Open the **Logs** app, then use the most specific filter you have: 1. Enter the conversation's **Root UUID** to see MCP calls from that conversation. 2. Select the MCP server from the **Plugin** filter to see calls to that server. 3. Select `mcp.tool.trigger` from the **Log Type** filter to see all MCP tool calls. You can combine these filters to narrow the results. Individual MCP tools are not available as a filter. Open a log entry to see its tool name. The [Log Type Reference](/tool-studio/agent-telemetry/logs/log-type-reference#mcptooltrigger) lists every field in an MCP tool call entry. ### Use the Log to Find the Failed Stage | What you see in the log | What to check | | ------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | No MCP log entry for the conversation | The assistant did not call an MCP tool. Go to [Stage 2: Tool Discovery and Selection](#stage-2-tool-discovery-and-selection). | | Unexpected or incomplete arguments | Compare the arguments with the user's request and the tool's input schema. Go to [Stage 3: Tool Execution](#stage-3-tool-execution). | | A successful call with an unexpected answer | Compare the response shown to the model with the MCP server's logs and raw response. Go to [Stage 4: Response Quality](#stage-4-response-quality). | | A failed call | Review the execution status and error message, then correlate the timestamp with the MCP server's logs. Go to [Stage 3: Tool Execution](#stage-3-tool-execution). | | High latency or intermittent failures | Check the latency and compare the same time period with upstream server health, timeouts, and rate limits. See [Timeouts, Progress, and Retries](/tool-studio/mcp-workspace/requirements-and-limits#timeouts-progress-and-retries). | ### Redacted Values Standard log redaction masks credentials and common personally identifiable information. Strict Log Redaction can replace log body values with `*****`. If a value is hidden, review the server's Strict Log Redaction and audience settings in Launch Configuration. Your organization's policy may require strict redaction for broadly available servers. [Log Data Security](/tool-studio/agent-telemetry/logs/log-redaction) explains the full redaction policy. ## Work Through the Four Stages Work through these stages in order. The first one that fails is where to focus. ### Stage 1: Connection and Authentication | What you see | Likely cause | What to do | | ----------------------------------------------------------------------- | ----------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Error adding or authenticating a server, or you cannot generate a token | The source app's OAuth configuration is wrong | Follow the source app's OAuth guidance, then run **Preview Tools** again. | | DCR reports that the server does not support OAuth discovery | The discovery URL or metadata is missing or incorrect | Check the discovery URL, Protected Resource Metadata, authorization-server metadata, `registration_endpoint`, and `S256` PKCE support. The registration endpoint alone is not a discovery URL. See [What a Server Must Support](/tool-studio/mcp-workspace/requirements-and-limits#what-a-server-must-support). | | The server worked yesterday but fails now | The provider rejected a token, or token refresh failed | Follow the [authentication recovery steps](#recover-from-an-authorization-failure). | | The server works for some users but not others | The affected users have not completed first-time in-chat authentication | Have each affected user sign in when the assistant prompts them. | ### Recover from an Authorization Failure An **Authorized** status does not prove that the upstream server still accepts the stored token. Moveworks refreshes tokens when needed, but an expired or revoked refresh token requires a new sign-in. 1. Ask the assistant for a specific task and name the app. If a connect prompt appears, complete sign-in, then repeat the request. 2. If the connection still fails or no prompt appears, open your Moveworks **Connections** page. Disconnect the affected integration, then authorize it again. 3. For an administrator's failed **Preview Tools** connection, use **Revoke Token**, authenticate again, and run **Preview Tools**. 4. If authentication still fails, compare the sanitized `401` or `403` error with the provider's token and permission settings. Revoking a token or disconnecting an integration removes that authorization. It does not remove the MCP server configuration. Do not delete and recreate a server to recover a user token. ### Stage 2: Tool Discovery and Selection | What you see | Likely cause | What to do | | ------------------------------------------------------------------- | --------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | A plugin runs instead of the MCP tool | Another tool can plausibly handle the same request | Reduce the overlap. In the moment, have the user name the app, such as "in Linear." | | The assistant calls Enterprise Search, gets nothing, then stops | It stopped before trying the more specific server | Have the user name the app explicitly in the request. | | Tools appear in Preview Tools but not in an employee's conversation | Administrator preview access differs from the employee's access | Check **Enabled**, Launch Configuration, the employee's sign-in, and upstream permissions. Preview Tools validates only the administrator connection. | | The expected tool never appears as an option | The tool description is too vague to match | Improve the description at the source app or server. It is view-only in Tool Studio. | | The assistant never calls any tool from a Custom Server | The server endpoint is entered incorrectly | Open the server in MCP Workspace and check the endpoint. The base URL must not end with a `/`, such as `https://mcp.example.com`, and the **Path** field must contain the server's Streamable HTTP path, such as `/mcp`. Correct the values, then run **Preview Tools** again. | ### Stage 3: Tool Execution | What you see | Likely cause | What to do | | -------------------------------------------------------- | ------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | A long-running call fails with a timeout | The platform or upstream server ended the request | Compare the call latency and error with server logs. Follow [timeout recovery](/tool-studio/mcp-workspace/requirements-and-limits#timeouts-progress-and-retries). | | The answer is truncated or degraded after a large result | The tool returned too much data | Scope the request more narrowly. | | Failures are intermittent and cluster under load | The upstream server is rate-limiting the call | Wait and retry. Check the upstream service for rate limits or errors. | | The tool returns something unexpected | The assistant sent wrong or incomplete arguments | Rephrase the request with the entity, project, field, or date range you need. | ### Stage 4: Response Quality | What you see | Likely cause | What to do | | ------------------------------------------------------ | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------- | | A plausible but wrong result | A broad tool returned data that was not scoped to the right item | Name the entity, project, field, or date range in the request. | | The result is technically right but poorly shaped | The response format is not tuned for the request | Rephrase with the format or level of detail you need. | | The same request returns different results across runs | The behavior is non-deterministic | Capture examples and escalate. There is no self-service configuration for this today. | ## Retry Before You Escalate Before you escalate, try the recovery step that matches the failed stage: 1. Ask the assistant, "Why didn't that work?" It can often explain whether sign-in, tool selection, or a tool call failed. 2. Retry with the app named and the request scoped to the entity, project, field, or date range you need. 3. If the server works for others but not the affected user, have that user complete the in-chat sign-in flow. ## Escalate with Useful Evidence If you identify the failed stage and do not have a self-service fix, include the following in your escalation: * Conversation URL or ID and the approximate timestamp with timezone. * The failed stage and the exact request. * The affected app and expected `mcp____` name, when known. * From the MCP tool call log, when one exists: the Root UUID, MCP server and tool name, Execution ID, execution status, and latency. * Expected and actual behavior. * A screenshot of Reveal AI Reasoning and, when available, Chat Playback. * The user-facing error text and safe server-side correlation details, such as a request ID, HTTP status, or stable error code. * Whether the issue reproduces, the affected pilot group, and any recent connector, server, or tool-description change. > **Do not include secrets** > > Do not include access tokens, refresh tokens, credentials, raw employee data, or unredacted upstream responses in an escalation.