anthropics / anthropics/claude-ai-mcp

Custom connector never sends bearer token to resource server after completing OAuth flow

Offen
#657 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
auth bug user-report
Vorherrschende Sprache
Keine Sprachdaten
Sterne
471
Forks
77
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

### MCP server URL or name

https://dev.grunewald.blog/wp-json/mcp/mcp-adapter-default-server

### How are you connecting to this server?

From a custom connector URL I entered manually

### Where does the issue occur?

When pressing the Connect button

### When did you last reproduce this?

2026-07-21

### Browser and OS

_No response_

### Describe the issue

Summary:
After a custom connector completes the full OAuth 2.1 authorization flow against a self-hosted MCP server (including Dynamic Client Registration per RFC 7591 and Protected Resource Metadata per RFC 9728), the connector never retries the original MCP request with the newly-issued access token. The connector stays in "Connection problem" status indefinitely, even though the authorization server issues a valid token every time.

Environment:

Custom connector, Server URL: https://dev.grunewald.blog/wp-json/mcp/mcp-adapter-default-server
Self-hosted OAuth 2.1 authorization server (WordPress plugin, built on league/oauth2-server)

Steps to reproduce:

Add a custom connector pointing to the MCP server URL above (or any MCP server behind a compliant OAuth 2.1 authorization server with DCR support).
Click "Connect" / re-authorize.
Complete the browser consent screen.

Observed server-side sequence (from access logs), all correct per spec:

POST /wp-json/mcp/mcp-adapter-default-server → 401 with WWW-Authenticate: Bearer resource_metadata="https://.../.well-known/oauth-protected-resource"
GET /.well-known/oauth-protected-resource → 200
GET /.well-known/oauth-authorization-server → 200
POST /gone-oauth/register (Dynamic Client Registration) → 201
GET /gone-oauth/authorize?... → 200 (consent screen shown)
POST /gone-oauth/authorize?... → 302 (user approved, redirected with code to https://claude.ai/api/mcp/auth_callback)
POST /gone-oauth/token → 200 (access token issued)

Expected: After step 7, the connector retries the original POST /wp-json/mcp/mcp-adapter-default-server request with Authorization: Bearer .

Actual: No further request to the MCP resource endpoint is made. In one reproduction, the connector instead repeated step 5/6 (/authorize) a second time with identical parameters, then still stopped. The UI shows "Connection failed. Check whether the URL points to a valid MCP server" / "Authorization with [connector name] failed", even though the token was successfully issued.

Additional note: The pre-existing broken connector entry cannot be deleted from claude.ai/settings/connectors — clicking it only re-triggers the OAuth flow, with no visible delete/remove option.

### Error details

```shell
Cannot Connect
```

### Expected behavior

Connects

### Additional context

_No response_

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Rechercherichtung

The report names no repository files or tests. Start by reproducing the custom-connector OAuth flow and inspect whether the post-token path retries the original MCP request with the issued bearer token; done means a successful authenticated request and a connected status without a second authorization cycle.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Bereich
api, authentication
Issue-Typ
Bug
Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Aktivitätsstatus
Ruhig
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
45/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.