Directory connector fails with authless_spec_mismatch when mcp_directory_server_uuid is present

### MCP server URL

https://mcp.zerobounce.net/oauth/mcp

### Where does the issue occur?

When pressing the Connect button

### Transport used

streamable-http

### Client registration type

Dynamic Client Registration (DCR)

### SSE only: Does your server return the expected status code for POST requests?

Not applicable (my server does not use SSE)

### When did you last reproduce this?

2026-08-05 08:25:14 GMT

### Browser and OS

Burp Suite's embedded browser (Burp Browser, Chromium-based) — Chromium 150 on macOS

### Describe the issue

Trying to install the MCP server via Claude's directory listing (Browse Connectors) fails while attempting to initiate OAuth with `authless_spec_mismatch` and the browser is never redirected to the
login page.
The identical URL added as a custom connector completes OAuth
successfully.
Moreover, a controlled test using Burp Browser isolates the failure to one field in the install
request: mcp_directory_server_uuid.

### Issue details

```shell
The connector works correctly when added as a custom connector, but fails when installed from the published directory listing.

Directory install request includes:
"mcp_directory_server_uuid": "b4fd876a-14cc-4bf8-93ce-537a7bca9422"
-> GET /mcp/start-auth/... returns `authless_spec_mismatch` immediately.
No request ever reaches our /oauth/authorize endpoint.

It does work when using a browser proxy (Burp) with a Match & Replace rule, and changing (only) this field in the same request, from the real UUID to null:
"mcp_directory_server_uuid": null
-> start-auth proceeds normally and the browser is redirected to
https://mcp.zerobounce.net/oauth/authorize as expected.

Adding the identical server URL via "Add custom connector" (which never includes
mcp_directory_server_uuid) also works correctly end to end.

---

Normal flow fails — GET /mcp/start-auth/41f20f32-... returns HTTP 400 at 2026-08-05 08:25:14 GMT:

json
{"error":{"message":"Failed to start MCP authorization","details":{"flow_id":"ofid_0d2c0e2379843593","error_code":"authless_spec_mismatch"}},"request_id":"req_011CdjHJWQzifj6HKwsYpPqh"}

Using "Match and Replace" in Burp Browser to set mcp_directory_server_uuid explicitly to null:
Succeeds - same endpoint returns HTTP 200 at 2026-08-05 08:27:42 GMT:

json
{"auth_url":"https://mcp.zerobounce.net/oauth/authorize?...","state":"...","prior_auth_status":"not_connected"}

followed by a 200 from ZeroBounce's /oauth/authorize rendering the real login form.
```

### Expected behavior

Installing via the published directory listing should behave similarly to the
custom-connector flow for the same URL: start-auth should proceed and redirect
the browser to our /oauth/authorize endpoint, since the server is not authless
and exposes valid DCR + authorization-server discovery metadata.

### Additional context

- Same behavior reproduced across multiple attempts (and different browsers)
- Sanitized request/response excerpts (cookies, auth headers, tokens redacted)
available on request; full HAR can be shared privately via a Claude support
ticket linked from this issue if needed
- Anthropic’s documentation states that directory and custom connectors use the same MCP infrastructure, including identical runtime, transport, authentication, and tool-calling code paths. Since the same server URL works as a custom connector but fails only when associated with the directory UUID, the evidence strongly points to directory-specific metadata, configuration, or record-association logic rather than the underlying connector runtime

Start by comparing the directory-install request with the custom-connector flow around mcp_directory_server_uuid and the /mcp/start-auth endpoint. Reproduce the HTTP 400 authless_spec_mismatch case, then verify that the directory flow proceeds to the server's /oauth/authorize endpoint like the null-field and custom-connector cases.

Vom Indexierungsmodell aus dem Issue-Text verfasst.