HTTP MCP servers with OAuth: tools not registered after successful auth

Resolved 💬 2 comments Opened Feb 28, 2026 by ivanvolca Closed Mar 29, 2026

Description

Tools from HTTP MCP servers that use OAuth 2.0 (with PKCE) are not surfaced in Claude Code's tool registry, even though the server connects and authenticates successfully.

Steps to Reproduce

  1. Configure a custom HTTP MCP server with OAuth 2.0 + PKCE in .mcp.json:
{
  "mcpServers": {
    "my-server": {
      "type": "http",
      "url": "https://example.com/mcp"
    }
  }
}
  1. The server implements standard OAuth 2.0 endpoints (.well-known/oauth-protected-resource, .well-known/openid-configuration, /register, /authorize, /token)
  1. Start Claude Code — OAuth flow completes successfully (browser opens, user authenticates, token exchanged)
  1. /mcp shows "Authentication successful. Reconnected to my-server"
  1. ToolSearch finds no tools from the server — they are not in the deferred tools list

Evidence the server works

Edge function logs confirm the full protocol succeeds:

  • GET /.well-known/oauth-protected-resource → 200
  • GET /.well-known/openid-configuration → 200
  • POST /register → 201
  • GET /authorize → 302
  • POST /authorize/session → 302
  • POST /token → 200
  • POST / (initialize) → 200
  • POST / (notifications/initialized) → 202
  • POST / (tools/list) → 200
  • GET / (SSE keep-alive) → 200 (ongoing)

ListMcpResourcesTool recognizes the server name, confirming the connection is active.

Comparison with working servers

HTTP MCP servers that do not use OAuth (e.g., Supabase MCP at mcp.supabase.com) register their tools correctly. The difference:

  • Working: mcp.supabase.com → no .well-known/oauth-protected-resource (404) → tools appear
  • Broken: Custom OAuth server → .well-known/oauth-protected-resource returns valid config → tools do not appear

Expected Behavior

After successful OAuth authentication, tools from the MCP server should appear in Claude Code's tool registry (either as deferred tools via ToolSearch or as directly callable tools).

Environment

  • Claude Code CLI (latest)
  • macOS Darwin 24.6.0
  • MCP SDK: @modelcontextprotocol/sdk@^1.24.3
  • Transport: @hono/mcp@^0.1.1 StreamableHTTPTransport with sessionIdGenerator: undefined (stateless mode)
  • Server: Supabase Edge Function (Deno runtime)

View original on GitHub ↗

This issue has 2 comments on GitHub. Read the full discussion on GitHub ↗