In July 12 commit b9499f9, different-ai/openwork added a structured MCP diagnostics module with distinct configuration, DNS, TCP, TLS, HTTP, OAuth, protocol, catalog, and provider-operation phases. “Could not connect” is not an operational diagnosis: for a team adding an MCP server, one opaque error turns a connection screen into an argument between the person who owns the network, the provider, and the credentials.
OpenWork's July 12 structured-diagnostics commit makes that ambiguity a first-class product surface. Its new diagnostic module follows the connection across configuration, DNS, TCP, TLS, HTTP routing, OAuth discovery and token work, MCP protocol, catalog, and provider-operation phases. A classified failure carries a reference ID, the highest stage that passed, retryability, an action owner, and a bounded instruction.
The message tells the operator where to go
An ENOTFOUND or EAI_AGAIN becomes a DNS failure for a network administrator; a TLS error becomes a certificate or transport problem; an OAuth discovery failure points to provider metadata; an expired shared credential can point to the organization administrator. A timeout can be retried, but a blocked private URL or forbidden port becomes a configuration and security decision. The code is trying to stop the wrong person from being sent to the wrong layer.
The route change that returns the diagnostic also uses a safe endpoint representation and a diagnostic log helper, rather than logging the raw connection URL and raw error object. The module limits native-error tokens, walks only a bounded cause chain, and uses a path hash in its outbound receipt. That does not prove perfect redaction. It does show a deliberate trade: keep enough evidence to correlate a failure, but not enough to turn error reporting into a second credential channel.
A clearer failure is still only a failure report
The accompanying test suite covers classifications and safe output around the new diagnostic path. The commit says its API, web, type, build, diff, TLS/HTTP/OAuth classification, and redaction probes passed in isolated sandboxes. That is an implementation receipt, not proof that an arbitrary third-party server will be reachable, compatible, or easy to repair in production.
The next signal worth watching is whether operators begin closing connection incidents with the reference ID and action owner in hand—or whether the new layer simply produces a better-shaped version of the same opaque escalation.