diff --git a/llama_stack/distribution/routing_tables/toolgroups.py b/llama_stack/distribution/routing_tables/toolgroups.py
index ac5e34783..5934ced21 100644
--- a/llama_stack/distribution/routing_tables/toolgroups.py
+++ b/llama_stack/distribution/routing_tables/toolgroups.py
@@ -8,7 +8,7 @@ from typing import Any
 
 from llama_stack.apis.common.content_types import URL
 from llama_stack.apis.tools import ListToolGroupsResponse, ListToolsResponse, Tool, ToolGroup, ToolGroups
-from llama_stack.distribution.datatypes import ToolGroupWithOwner
+from llama_stack.distribution.datatypes import AuthenticationRequiredError, ToolGroupWithOwner
 from llama_stack.log import get_logger
 
 from .common import CommonRoutingTableImpl
@@ -56,7 +56,13 @@ class ToolGroupsRoutingTable(CommonRoutingTableImpl, ToolGroups):
                 if toolgroup.identifier not in self.toolgroups_to_tools:
                     await self._index_tools(toolgroup)
                 all_tools.extend(self.toolgroups_to_tools[toolgroup.identifier])
+            except AuthenticationRequiredError:
+                # Send authentication errors back to the client so it knows
+                # that it needs to supply credentials for remote MCP servers.
+                raise
             except Exception as e:
+                # Other errors that the client cannot fix are logged and
+                # those specific toolgroups are skipped.
                 logger.warning(f"Error listing tools for toolgroup {toolgroup.identifier}: {e}")
                 logger.debug(e, exc_info=True)
                 continue