Remote MCP (mcp.socket.dev) rejects freshly-issued OAuth access tokens with 401 invalid_token

Summary

The remote Socket MCP server at https://mcp.socket.dev/ rejects access tokens that its own OAuth flow just issued. The token is valid and unexpired — the same token authenticates successfully against api.socket.dev — but every MCP request returns 401 invalid_token. This makes the remote MCP server unusable with OAuth-capable MCP clients (tested with Claude Code).

Environment

• Client: Claude Code (streamable HTTP MCP client with OAuth + dynamic client registration)
• Server: https://mcp.socket.dev/
• Account: Socket org clivi (team plan), reproduced consistently across 2 days (2026-06-09 and 2026-06-10)

Steps to reproduce

1. Add the remote server per the docs: claude mcp add --transport http socket-mcp https://mcp.socket.dev/
2. Complete the OAuth flow (DCR client, e.g. client_id=dcr-f8TfK-9JQzUGucp7lDJCymIp, scope packages:list, resource=https://mcp.socket.dev/). The browser flow finishes with "Authentication successful".
3. Client receives and stores an access token (sktsec_…, 55 chars, ~15-minute TTL) plus a refresh token.
4. Immediately (>10 minutes before expiry) call the MCP endpoint with the token:

curl -X POST https://mcp.socket.dev/ \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"diag","version":"1.0"}}}'

Expected

200 with an initialize result.

Actual

HTTP/2 401
www-authenticate: Bearer error="invalid_token", error_description="Invalid or expired token", resource_metadata="https://mcp.socket.dev/.well-known/oauth-protected-resource"
{"error":"invalid_token","error_description":"Invalid or expired token"}

Evidence the token itself is valid

The exact same token, at the same moment, works against the regular API:

curl https://api.socket.dev/v0/organizations -H "Authorization: Bearer $ACCESS_TOKEN"
# 200 — returns the org as expected

So issuance, scope (packages:list, which matches the resource metadata's scopes_supported), audience/resource binding, and storage are all fine — only the MCP resource server's token validation fails.

Additional observations

• The Remote Socket MCP docs say "No API key or authentication required!" — but unauthenticated requests get 401 with error_description="Missing Authorization header". If auth is now required, the docs are stale; if it isn't, the 401s are the bug.
• https://mcp.socket.dev/mcp (referenced in the Windsurf section of those docs) returns 404.
• Workaround that works fine: local stdio server (@socketsecurity/mcp) with a static API key of the same packages:list scope. (Side note: its engines field requires npm ≥ 11.16, which no current Node release bundles — npx fails out of the box; pnpm dlx works.)

Start at the remote MCP endpoint https://mcp.socket.dev/ and trace how its OAuth bearer tokens are validated, comparing that path with the working api.socket.dev request. Reproduce the issue with the provided curl commands and inspect the remote Socket MCP documentation and OAuth protected-resource metadata. Done means a freshly issued token can initialize MCP successfully, with authentication behavior and documentation aligned.