HTTP MCP servers with OAuth: tools not registered after successful auth
Resolved 💬 2 comments Opened Feb 28, 2026 by ivanvolca Closed Mar 29, 2026
Description
Tools from HTTP MCP servers that use OAuth 2.0 (with PKCE) are not surfaced in Claude Code's tool registry, even though the server connects and authenticates successfully.
Steps to Reproduce
- Configure a custom HTTP MCP server with OAuth 2.0 + PKCE in
.mcp.json:
{
"mcpServers": {
"my-server": {
"type": "http",
"url": "https://example.com/mcp"
}
}
}
- The server implements standard OAuth 2.0 endpoints (
.well-known/oauth-protected-resource,.well-known/openid-configuration,/register,/authorize,/token)
- Start Claude Code — OAuth flow completes successfully (browser opens, user authenticates, token exchanged)
/mcpshows "Authentication successful. Reconnected to my-server"
ToolSearchfinds no tools from the server — they are not in the deferred tools list
Evidence the server works
Edge function logs confirm the full protocol succeeds:
GET /.well-known/oauth-protected-resource→ 200GET /.well-known/openid-configuration→ 200POST /register→ 201GET /authorize→ 302POST /authorize/session→ 302POST /token→ 200POST /(initialize) → 200POST /(notifications/initialized) → 202POST /(tools/list) → 200GET /(SSE keep-alive) → 200 (ongoing)
ListMcpResourcesTool recognizes the server name, confirming the connection is active.
Comparison with working servers
HTTP MCP servers that do not use OAuth (e.g., Supabase MCP at mcp.supabase.com) register their tools correctly. The difference:
- Working:
mcp.supabase.com→ no.well-known/oauth-protected-resource(404) → tools appear - Broken: Custom OAuth server →
.well-known/oauth-protected-resourcereturns valid config → tools do not appear
Expected Behavior
After successful OAuth authentication, tools from the MCP server should appear in Claude Code's tool registry (either as deferred tools via ToolSearch or as directly callable tools).
Environment
- Claude Code CLI (latest)
- macOS Darwin 24.6.0
- MCP SDK:
@modelcontextprotocol/sdk@^1.24.3 - Transport:
@hono/mcp@^0.1.1StreamableHTTPTransportwithsessionIdGenerator: undefined(stateless mode) - Server: Supabase Edge Function (Deno runtime)
This issue has 2 comments on GitHub. Read the full discussion on GitHub ↗