anthropics / anthropics/claude-ai-mcp

Custom connector authorization does not persist (~10 min) on a Team org; identical connector persists indefinitely on a personal account

Open
#963 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
471
Forks
76
PR merge metrics
No merged PRs in 30d

Description

### What happened?

Summary

A custom MCP connector authorizes successfully on a Team-plan organisation and loses its authorization roughly ten minutes later. The connector row reverts to "Connect" and no tools load. Reconnecting succeeds and fails again identically, repeatedly. The same connector — same URL, same upstream account, same authorization flow — has been continuously connected for days on a personal account.

Environment

Claude on web, Team plan organisation
Custom MCP connector added by an Owner, individual authorization
Connector URL: https://huggingface.co/mcp?login&gradio=mcp-tools/Z-Image-Turbo,mcp-tools/Qwen-Image-Fast
Connector settings left at detected defaults (authentication "always required"; both dynamic client registration and Anthropic-hosted client metadata were tried)

Expected

The connector remains authorized, with Claude refreshing the upstream access token as it does on a personal account.

Actual

Authorization is lost approximately ten minutes after a successful connect. This is far shorter than the upstream provider's access-token lifetime, so it does not appear to be plain expiry — the authorization does not appear to persist.

Control case (the key evidence)

The identical connector on a personal Claude account, same URL and same upstream account, has stayed connected for days with no manual action, and its credential is demonstrably refreshing:

measured 28 Aug 2026: expires_at 2026-08-28T15:00:17Z
measured 31 Aug 2026: expires_at 2026-08-31T17:05:00Z

Same upstream service, same upstream account, same connector URL. The only variable that differs is which Claude account holds the connector.

Registration failure during setup

Adding the connector repeatedly failed with "Unable to register with the login service." Error reference: ofid_97b240cec0574a3e (31 Aug 2026, ~13:48 Europe/Zurich, UTC+2). The registration that eventually succeeded is the one now failing to persist, which suggests the client record was provisioned incompletely or without a refresh token.

Already ruled out

Connector URL, upstream account identity, the upstream tool/Space list, both OAuth client modes, deleting and re-creating the connector, per-chat enablement, and browser vs desktop app.

Possibly related

#840 — custom connectors never requesting offline_access, so no refresh token is issued and the connection dies silently at expiry while still displaying as connected. The symptom here is the same class, but with a much shorter window.

Ask

Can the client registration behind ofid_97b240cec0574a3e be traced to confirm whether the client record is complete and whether a refresh token was issued — and re-provisioned if not? Happy to supply the organisation name and account identifiers privately.

### What did you expect to happen?

The connector should remain authorized after a successful connect, with
Claude refreshing the upstream access token automatically, as it does for
the identical connector on a personal account. Instead the authorization is
lost after roughly ten minutes and the connector reverts to "Connect" with
no tools available in any chat.

### Steps to reproduce

1. On a Team-plan organisation, an Owner adds a custom MCP connector with
the URL https://huggingface.co/mcp?login&gradio=mcp-tools/Z-Image-Turbo,mcp-tools/Qwen-Image-Fast
(all connector settings left at the detected defaults).
2. Click Connect and complete the OAuth authorization with a Hugging Face
account. The connection succeeds.
3. Open a new chat, enable the connector, and confirm its tools load and
work. They do.
4. Wait approximately ten minutes.
5. Return to the connectors list: the row has reverted to "Connect" and no
tools load in any chat. Reconnecting succeeds and fails again the same way.

Control: repeat the same steps on a personal Claude account with the same
URL and the same Hugging Face account. There the connector stays authorized
for days and its credential refreshes automatically.

### Area

MCP Connector (adding/managing servers)

### MCP Server (if applicable)

custom server — Hugging Face MCP (https://huggingface.co/mcp)

### Error messages or logs

```shell
During connector setup, repeated failures at client registration:

"Unable to register with the login service. You can retry, or add an
OAuth Client ID in the connector settings. If the problem persists,
share this reference with support: ofid_97b240cec0574a3e"

Error reference: ofid_97b240cec0574a3e
Timestamp: 31 Aug 2026, ~13:48 Europe/Zurich (UTC+2)

Credential refresh on the working personal account, for comparison:
measured 28 Aug 2026: expires_at 2026-08-28T15:00:17Z
measured 31 Aug 2026: expires_at 2026-08-31T17:05:00Z

No error is surfaced when the Team-org connector drops — it simply reverts
to "Connect".
```

### Additional context

_No response_

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.