This is a classic credential-precedence bug — and a genuinely dangerous one since it silently flips billing from subscription to metered API without any signal beyond a two-word label. **Root cause:*…
Good diagnosis. This is a general DCR lifecycle problem that affects ALL self-hosted MCP servers, not just Metabase. The core issue is that Claude Code treats DCR as a one-time setup rather than an o…
This is a textbook OAuth token refresh race condition. The concentration pattern (4 sessions, 295 401s in 30h) points to a shared credential store where multiple concurrent sessions are all refreshin…
Good catch — this is a classic async job lifecycle bug where the error-handling intent ("don't crash the server") accidentally swallows the failure signal. The fix is straightforward and localized to…
This is a well-isolated bug report — the fact that it reproduces on `web_fetch` (a built-in, not an MCP connector) is the key finding that rules out connector-specific approval gating. The silent-han…
This is likely a transport ownership issue — the MCP connection's lifecycle is bound to the tab's JavaScript context rather than a shared background execution context. **What's probably happening:** …
This is almost certainly a context-assembly divergence between the UI rendering path and the model message-construction path — they process the same `content[]` array differently. **The two paths:** …
This is the classic OAuth authorization vs. GitHub App installation distinction — two independent flows that tools often conflate into one "connected" state. **What's happening:** - **OAuth** (`Autho…
The core bug: when a custom connector is configured with static "Request headers" auth, claude.ai ignores the configured header and initiates an OAuth authorization_code flow instead — using the lite…
The issue is that after receiving HTTP 401 with a valid `WWW-Authenticate` header, claude.ai stops the connection flow instead of continuing with OAuth discovery. Your server logs confirm: `POST /api…
Great debugging — you've traced the full OAuth discovery chain. The root cause is clear: when the client can't reach authorization-server metadata at the server-specific well-known paths (claude.ai r…
Nice diagnosis on the `_ready` ordering bug. This is the same class of issue we hit when building our MCP server's reconnection layer (36 business API connectors at corpusiq.io) — the core problem is…
This has the same root cause as #78911 (MCP session silently wedges) — the client reuses a pooled connection that was closed during idle, and there's no detection/recovery. What's interesting here is…
This CLI-vs-web disconnect on OAuth is something we debugged extensively while building our MCP server (36 business API connectors at corpusiq.io). The pattern you're seeing — token endpoint returns …
This looks like the transport layer lacks an application-level heartbeat. I've hit the same pattern across Streamable HTTP and SSE transports — the session negotiates fine at init, but there's no kee…
The use case makes sense — you have a secret store that injects values into env vars, but custom headers need to be `"key: value"` pairs, and there's no interpolation path to pull the secret in. A fe…
This is a legitimate gap. API key authentication (x-api-key header) is a first-class MCP transport auth method — not everything needs the full OAuth dance. Many MCP servers, especially internal/custo…
The root cause here is that `remoteControlAtStartup` fires its bridge initialization eagerly — before the OAuth token refresh promise settles. The `--rc` flag works because that code path defers brid…
The key diagnostic here is that Claude's backend performs OAuth discovery (GET on `.well-known` returns 200) but never POSTs to `/token`. The authorization code is obtained (Entra sign-in logs show s…
This is a real security concern — especially the agent-transcript propagation vector you identified. In agent-driven workflows (Claude Code invoked by another orchestrator, or session transcripts tha…
This looks like a client-side session re-establishment issue with stateless streamable-HTTP servers. We've seen this pattern when running MCP servers that intentionally omit `Mcp-Session-Id`. The roo…
Great analysis — you've nailed the root cause. This is a JSON Schema normalization bug where the empty schema `{}` is being incorrectly collapsed to `false` instead of `true`. The key insight from th…
The `mcp_stdio_watchdog` uses `psutil` to monitor the child process after spawning. The issue you're hitting is that `uvx` is a **two-layer spawn**: `uvx` is itself a Python entry point that installs…
Nice diagnostic table — the "token=200 then silence" pattern you've isolated between CLI and web is exactly the right level of detail. Based on the symptoms (token endpoint returns 200, session creat…
This is a classic token propagation gap between the auth flow layer and the tool-calling layer. The `/mcp` command's OAuth flow successfully refreshes the token (you're seeing "Authentication success…
Thanks for the thorough diagnosis — you've already done the hard work of tracing this to the root cause. The mismatch between #17733 and your server-side verification is the key: your server correctl…