Lazy authentication not working from Claude.ai

### MCP server URL

https://mcp.hostafrica.com/mcp

### Where does the issue occur?

When pressing the Connect button

### Transport used

streamable-http

### Client registration type

Dynamic Client Registration (DCR)

### SSE only: Does your server return the expected status code for POST requests?

Not applicable (my server does not use SSE)

### When did you last reproduce this?

2026-08-04

### Browser and OS

Chrome 150.0.7871.184

### Describe the issue

On our connector (custom currently) we have lazy auth configured so that the connect can happen without authentication, the tools list retrieved and the public unauthenticated tools in the list can be called. When protected tools are called the auth card is presented.
On MCP Inspector this behaviour works (legacy MCP 2025-11-25), but on Claude.ai the auth card is presented immediately on clicking Connect, even with a new Claude account. Claude used to work but something seems to have changed in the last month.

### Issue details

```shell
user: a.smith@md-3.com

When cancelling the connect in the auth card the error ref is:
Authorization with the MCP server failed. You can check your credentials and permissions. If this persists, share this reference with support: “ofid_4829432bf76d81b3"
```

### Expected behavior

we have lazy auth configured so that the connect can happen without authentication, the tools list retrieved and the public unauthenticated tools in the list can be called. When protected tools are called the auth card is presented.

### Logs from your server

```shell
{ /* Claude initialize */
"ts": "2026-08-04T09:11:21.380Z",
"level": "INFO",
"category": "http",
"request_id": "dcdc5805-ad60-441e-9058-68dcde3cd0e0",
"remoteIP": "[REDACTED_IP]",
"user_agent": "python-httpx/0.28.1",
"source": "http",
"event": "request",
"method": "POST",
"path": "/mcp",
"request_headers": {
"host": "mcp.hostafrica.com",
"accept-encoding": "gzip, deflate, br, zstd",
"user-agent": "python-httpx/0.28.1",
"mcp-protocol-version": "2025-11-25",
"content-type": "application/json",
"accept": "application/json, text/event-stream",
"content-length": "158",
"x-cloud-trace-context": "eceaa407c11723493479c3a1cd662892/3645337095395875665;o=1",
"traceparent": "00-eceaa407c11723493479c3a1cd662892-3296d6c641a01b51-01",
"x-real-ip": "[REDACTED_IP]",
"x-forwarded-for": "[REDACTED_IP]"
},
"request_body": {
"jsonrpc": "2.0",
"id": 1,
"method": "initialize",
"params": {
"protocolVersion": "2025-11-25",
"capabilities": {},
"clientInfo": {
"name": "Anthropic",
"version": "1.0.0"
}
}
}
},
{ /* Claude initialize response 200 */
"ts": "2026-08-04T09:11:21.417Z",
"level": "INFO",
"category": "http",
"request_id": "dcdc5805-ad60-441e-9058-68dcde3cd0e0",
"remoteIP": "[REDACTED_IP]",
"user_agent": "python-httpx/0.28.1",
"source": "http",
"event": "response",
"method": "POST",
"path": "/mcp",
"content_type": "application/json; charset=utf-8",
"duration_ms": 37,
"response_body": "{\"jsonrpc\":\"2.0\",\"id\":1,\"result\":{\"protocolVersion\":\"2025-11-25\",\"capabilities\":{\"prompts\":{\"listChanged\":true},\"resources\":{\"subscribe\":true},\"tools\":{}},\"serverInfo\":{\"name\":\"HostAfrica API\",\"version\":\"1.0.0\"},\"instructions\":\"This MCP server provides HostAfrica VPS management and domain search tools. Use check_domain_availability to check availability of specific domains, and suggest_domains to generate creative domain ideas from a description. Each domain result includes a 'register_url' field for available domains — always present this as a prominent registration button; never tell the user to search manually on the website. IMPORTANT: register_url is currency-specific and only valid for the currency returned in that tool response. always call the tool again with the new currency to get a fresh register_url. Supported currencies: ZAR (default), USD, NGN, KES, GHS, EUR, EGP.check_domain_availability and suggest_domains tools are public; all other tools require authentication.\"}}\n",
"response_body_kind": "text",
"status_code": 200
},
{ /* Claude /.well-known/oauth-protected-resource/mcp */
"ts": "2026-08-04T09:11:22.155Z",
"level": "INFO",
"category": "http",
"request_id": "354e6f48-6214-412b-9819-c3a8792cf44b",
"remoteIP": "[REDACTED_IP]",
"user_agent": "python-httpx/0.28.1",
"source": "http",
"event": "request",
"method": "GET",
"path": "/.well-known/oauth-protected-resource/mcp",
"request_headers": {
"host": "mcp.hostafrica.com",
"accept": "*/*",
"accept-encoding": "gzip, deflate, br, zstd",
"user-agent": "python-httpx/0.28.1",
"mcp-protocol-version": "2025-11-25",
"x-cloud-trace-context": "eceaa407c11723493479c3a1cd662892/17650777280394395332;o=1",
"traceparent": "00-eceaa407c11723493479c3a1cd662892-f4f4286b2f717ec4-01",
"x-real-ip": "[REDACTED_IP]",
"x-forwarded-for": "[REDACTED_IP]"
},
"request_body": {}
},
{ /* Claude /.well-known/oauth-protected-resource/mcp response 200 */
"ts": "2026-08-04T09:11:22.156Z",
"level": "INFO",
"category": "http",
"request_id": "354e6f48-6214-412b-9819-c3a8792cf44b",
"remoteIP": "[REDACTED_IP]",
"user_agent": "python-httpx/0.28.1",
"source": "http",
"event": "response",
"method": "GET",
"path": "/.well-known/oauth-protected-resource/mcp",
"content_type": "application/json; charset=utf-8",
"duration_ms": 1,
"response_body": "{\"resource\":\"https://mcp.hostafrica.com/mcp\",\"authorization_servers\":[\"https://mcp.hostafrica.com\"]}",
"response_body_kind": "text",
"status_code": 200
},
{ /* Claude /.well-known/oauth-authorization-server */
"ts": "2026-08-04T09:11:22.877Z",
"level": "INFO",
"category": "http",
"request_id": "774dfceb-3ed7-405a-822c-bf26ebe2e5e9",
"remoteIP": "[REDACTED_IP]",
"user_agent": "python-httpx/0.28.1",
"source": "http",
"event": "request",
"method": "GET",
"path": "/.well-known/oauth-authorization-server",
"request_headers": {
"host": "mcp.hostafrica.com",
"accept": "*/*",
"accept-encoding": "gzip, deflate, br, zstd",
"user-agent": "python-httpx/0.28.1",
"mcp-protocol-version": "2025-11-25",
"x-cloud-trace-context": "eceaa407c11723493479c3a1cd662892/17621195608590616442;o=1",
"traceparent": "00-eceaa407c11723493479c3a1cd662892-f48b100b7fb7877a-01",
"x-real-ip": "[REDACTED_IP]",
"x-forwarded-for": "[REDACTED_IP]"
},
"request_body": {}
},
{ /* Claude /.well-known/oauth-authorization-server response 200 */
"ts": "2026-08-04T09:11:22.879Z",
"level": "INFO",
"category": "http",
"request_id": "774dfceb-3ed7-405a-822c-bf26ebe2e5e9",
"remoteIP": "[REDACTED_IP]",
"user_agent": "python-httpx/0.28.1",
"source": "http",
"event": "response",
"method": "GET",
"path": "/.well-known/oauth-authorization-server",
"content_type": "application/json; charset=utf-8",
"duration_ms": 2,
"response_body": "{\"issuer\":\"https://mcp.hostafrica.com\",\"authorization_endpoint\":\"https://mcp.hostafrica.com/authorize\",\"token_endpoint\":\"https://mcp.hostafrica.com/token\",\"revocation_endpoint\":\"https://mcp.hostafrica.com/revoke\",\"registration_endpoint\":\"https://mcp.hostafrica.com/register\",\"response_types_supported\":[\"code\"],\"grant_types_supported\":[\"authorization_code\",\"refresh_token\"],\"code_challenge_methods_supported\":[\"S256\"],\"token_endpoint_auth_methods_supported\":[\"none\"],\"scopes_supported\":[\"mcp\"]}",
"response_body_kind": "text",
"status_code": 200
},
{ /* Claude /register */
"ts": "2026-08-04T09:11:23.665Z",
"level": "INFO",
"category": "http",
"request_id": "f94b28a9-f5cc-4017-8175-6a2392da198f",
"remoteIP": "[REDACTED_IP]",
"user_agent": "python-httpx/0.28.1",
"source": "http",
"event": "request",
"method": "POST",
"path": "/register",
"request_headers": {
"host": "mcp.hostafrica.com",
"accept": "*/*",
"accept-encoding": "gzip, deflate, br, zstd",
"user-agent": "python-httpx/0.28.1",
"content-type": "application/json",
"content-length": "238",
"x-cloud-trace-context": "eceaa407c11723493479c3a1cd662892/17194457994824849579;o=1",
"traceparent": "00-eceaa407c11723493479c3a1cd662892-ee9efc7236e918ab-01",
"x-real-ip": "[REDACTED_IP]",
"x-forwarded-for": "[REDACTED_IP]"
},
"request_body": {
"redirect_uris": [
"https://claude.ai/api/mcp/auth_callback"
],
"token_endpoint_auth_method": "none",
"grant_types": [
"authorization_code",
"refresh_token"
],
"response_types": [
"code"
],
"scope": "mcp",
"client_name": "Claude",
"application_type": "web"
}
},
{ /* Claude /register response 201 */
"ts": "2026-08-04T09:11:23.667Z",
"level": "INFO",
"category": "http",
"request_id": "f94b28a9-f5cc-4017-8175-6a2392da198f",
"remoteIP": "[REDACTED_IP]",
"user_agent": "python-httpx/0.28.1",
"source": "http",
"event": "response",
"method": "POST",
"path": "/register",
"content_type": "application/json; charset=utf-8",
"duration_ms": 2,
"response_body": "{\"client_id\":\"hostafrica-mcp-client\",\"client_id_issued_at\":1785834683,\"redirect_uris\":[\"https://claude.ai/api/mcp/auth_callback\"],\"client_name\":\"Claude\",\"grant_types\":[\"authorization_code\",\"refresh_token\"],\"response_types\":[\"code\"],\"token_endpoint_auth_method\":\"none\",\"scope\":\"mcp\"}",
"response_body_kind": "text",
"status_code": 201
},
{ /* Claude (browser) /authorize (authentication card) */
"ts": "2026-08-04T09:11:24.430Z",
"level": "INFO",
"category": "http",
"request_id": "60cc718c-f8f7-46ae-a830-f18e3e5bf36b",
"remoteIP": "[REDACTED_IP]",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
"client_id": "hostafrica-mcp-client",
"source": "http",
"event": "request",
"method": "GET",
"path": "/authorize?response_type=code&client_id=hostafrica-mcp-client&redirect_uri=https%3A%2F%2Fclaude.ai%2Fapi%2Fmcp%2Fauth_callback&code_challenge=[REDACTED_PKCE]&code_challenge_method=S256&state=[REDACTED_STATE]&scope=mcp&resource=https%3A%2F%2Fmcp.hostafrica.com%2Fmcp",
"request_headers": {
"host": "mcp.hostafrica.com",
"sec-ch-ua": "\"Not;A=Brand\";v=\"8\", \"Chromium\";v=\"150\", \"Google Chrome\";v=\"150\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"macOS\"",
"upgrade-insecure-requests": "1",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
"accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
"sec-fetch-site": "cross-site",
"sec-fetch-mode": "navigate",
"sec-fetch-user": "?1",
"sec-fetch-dest": "document",
"referer": "https://claude.ai/",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "en-US,en;q=0.9",
"priority": "u=0, i",
"cookie": "[REDACTED]",
"x-real-ip": "[REDACTED_IP]",
"x-forwarded-for": "[REDACTED_IP]"
},
"query": {
"response_type": "code",
"client_id": "hostafrica-mcp-client",
"redirect_uri": "https://claude.ai/api/mcp/auth_callback",
"code_challenge": "[REDACTED_PKCE]",
"code_challenge_method": "S256",
"state": "[REDACTED_STATE]",
"scope": "mcp",
"resource": "https://mcp.hostafrica.com/mcp"
},
"request_body": {}
},
{ /* Claude (browser) /authorize response 200 (authentication card) */
"ts": "2026-08-04T09:11:24.435Z",
"level": "INFO",
"category": "http",
"request_id": "60cc718c-f8f7-46ae-a830-f18e3e5bf36b",
"remoteIP": "[REDACTED_IP]",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
"client_id": "hostafrica-mcp-client",
"source": "http",
"event": "response",
"method": "GET",
"path": "/authorize?response_type=code&client_id=hostafrica-mcp-client&redirect_uri=https%3A%2F%2Fclaude.ai%2Fapi%2Fmcp%2Fauth_callback&code_challenge=[REDACTED_PKCE]&code_challenge_method=S256&state=[REDACTED_STATE]&scope=mcp&resource=https%3A%2F%2Fmcp.hostafrica.com%2Fmcp",
"content_type": "text/html; charset=utf-8",
"duration_ms": 5,
"response_body": "...",
"response_body_kind": "html",
"status_code": 200
}
```

### Additional context

Currently testing for a submission to Claude Connector Directory

Start by reproducing the Connect flow against the reported /mcp endpoint and compare Claude.ai with MCP Inspector. Trace the OAuth discovery, /register, and /authorize requests in the logs; done means public tools can be listed and called before the authentication card appears for a protected tool.

Vom Indexierungsmodell aus dem Issue-Text verfasst.