Error: session_limit — concurrent session cap reached
The CLI connected, authenticated, and was then refused:
free plan allows 3 concurrent sessions per tunnel (3 already connected)The machine-readable code is session_limit. It arrives as a protocol frame on
the control connection, not as an HTTP response — so there is no status code to
match on; the connection is closed straight after.
What it means
Section titled “What it means”A tunnel accepts several concurrent CLI sessions — Claude Desktop, Cursor and a CI job can all sit behind one public URL. Each plan caps how many at once:
| Plan | Concurrent sessions per tunnel |
|---|---|
| Free | 3 |
| Pro | 10 |
| Scale | 25 |
You hit the cap. The numbers in the message are live: the first is your plan’s ceiling, the second is how many sessions were already connected when you tried.
The new connection is refused, not the old one
Section titled “The new connection is refused, not the old one”This is the part worth understanding, because the opposite behaviour is common elsewhere: mcppipe rejects the arriving connection and leaves the running ones untouched. It never silently drops a session that is serving an agent in order to make room.
That is a deliberate contract. A silent displacement is invisible at the moment it matters — the agent whose session was taken away just starts failing, with nothing in its logs to explain why. An explicit refusal to the connection that caused the problem puts the error in front of the person who can act on it.
A reconnect does not count against the cap
Section titled “A reconnect does not count against the cap”If a session drops and the CLI comes back within the resume window, it resumes the existing session rather than creating a new one. So a flapping network does not eat your budget — you will not watch a laptop on bad Wi-Fi consume all three Free slots by reconnecting.
The cap only applies to genuinely new sessions. See Reliability: reconnect & sessions.
Find out what is actually connected. The tunnel’s detail page shows current sessions. A stale container or a forgotten terminal is the usual culprit — especially in CI, where a job that was killed without a clean shutdown may still hold a session until it times out.
Split across tunnels. Nothing says one tunnel per project. If two teams or two environments are sharing a tunnel because it was convenient, give them one each — tunnel count is a separate quota (Free 2, Pro 5, Scale 20), and hitting that one returns 402 instead.
Upgrade. Pro raises the cap to 10 per tunnel and Scale to 25. See Billing & plans.
Not this error?
Section titled “Not this error?”- The key was rejected before any of this:
authentication failed. - The tunnel is up but an agent’s request is refused: 401, 403 or 429.