AI Hub Troubleshooting

Solutions for common issues when setting up or using AI Hub. For setup instructions, see Set Up AI Hub.

Authentication failed

Symptoms: authentication errors, "Unauthorized" responses, unable to load organization context

Solutions:

1. Log in to the CloudZero platform directly to verify your account access.
2. Clear cookies for cloudzero.com in your default browser and try again.
3. Restart your AI tool to trigger fresh authentication.

OAuth client authorization fails

Symptoms: an agent platform returns invalid_client, or the CloudZero sign-in screen never opens

This applies to enterprise agent platforms connected with an OAuth client.

Solutions:

1. Confirm the client still exists. Go to Settings > Preferences & Extensions > MCP OAuth Clients. A revoked client cannot be restored, so create a new one and enter its credentials in the platform.
2. Confirm the platform has the current client secret. Rotating a secret invalidates the previous one immediately. Enter the new secret in the platform's connector configuration.
3. Confirm the client has at least one redirect URI. A client showing the Setup Incomplete badge cannot complete an authorization until you add the platform's callback URL.
4. Confirm the platform supports Proof Key for Code Exchange (PKCE) with the S256 method. The MCP server requires it in addition to the client secret.

Redirect URI mismatch

Symptoms: sign-in starts but the platform reports an unregistered or mismatched redirect URI

Solutions:

1. Copy the callback URL from your platform and compare it character for character against the URIs registered on the client. CloudZero matches them exactly, with one exception: loopback URIs match on any port.
2. Add the missing URL through Edit on the client. Saving replaces the entire redirect URI list, so keep every URL that should stay valid in the form.

Token exchange fails with Method Not Allowed

Symptoms: an agent platform reports that the token exchange failed with Method Not Allowed or status 405, right after the user approved access on the CloudZero sign-in screen

This applies to enterprise agent platforms connected with an OAuth client through a generic OAuth 2.0 connector. The platform's Token URL points at a .well-known discovery URL or at the Authorization URL, and only the token endpoint accepts a token request.

Solution: In the platform's connector configuration, set both Token URL and Refresh URL to https://czca-server.discovery.cloudzero.com/token, then have the user sign in again. For every value the connector needs, see Platforms that ask for individual endpoints.

Lost OAuth client secret

Symptoms: you need an OAuth client secret and it is not in your secrets manager

CloudZero displays a client secret only when the client is created or its secret is rotated, and there is no way to retrieve it afterward.

Solution: Select Rotate secret on the client to issue a new secret, then enter it in your platform's connector configuration. The client ID and registered redirect URIs stay the same, so nothing else needs to change. For details, see Rotate the client secret.

Plugin not found

Symptoms: "Plugin not found" when trying to install the Claude Code Plugin

Solutions:

1. Add the marketplace first:
   Bash

   claude plugin marketplace add cloudzero/cloudzero-claude-marketplace

2. Then install the plugin:
   Bash

   claude plugin install cost-analyst@cloudzero

No data returned

Symptoms: "No cost data found" or empty results

Solutions:

1. Try a different time range. Verify data exists for the period in the CloudZero platform.
2. Broaden your filters. Remove specific service or account filters.
3. Recent cost data takes 24-48 hours to appear after connecting a new provider.

Response too large

Symptoms: "produced a response of X.X MB, which exceeds the 5 MB limit"

Solutions:

1. Narrow the date range (for example, last 7 days instead of last 90 days).
2. Add filters to scope the query to specific accounts, services, or teams.
3. Ask for fewer results or group by a broader category.

AI agents that receive this error retry with a narrower query automatically. For the underlying limits, see MCP Server Reference.

Quota exceeded

Symptoms: "Daily API key organization quota exceeded"

This applies to API key authentication only. OAuth users are not metered.

Solutions:

1. The quota resets at midnight UTC. Wait and try again after the reset.
2. If you consistently reach the daily limit, contact your account manager.

For details on quota thresholds and warnings, see MCP Server Reference.