Cannot authorize new MCP server when adding

### Self Checks

- [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542).
- [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general).
- [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones.
- [x] I confirm that I am using English to submit this report, otherwise it will be closed.
- [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
- [x] Please do not modify this template :) and fill in all the required fields.

### Dify version

1.16.1

### Cloud or Self Hosted

Self Hosted (Docker)

### Steps to reproduce

- Install Self Hosted Dify
- Go to Integrations > Tools > MCP to add new MCP
- Cannot authorize MCP server -> `Tried to add new MCP server on dify cloud with same steps and it worked well`
- Issue image

- logs
```bash
worker-1 | 2026-08-04 11:12:17.729 INFO [Dummy-139] [trace.py:128] 238e410db5235623bcede1f8ab470fb2 - Task schedule.workflow_schedule_task.poll_workflow_schedules[9fa77481-8f2d-45ac-99ac-3d43645fb9ca] succeeded in 0.09149162399990018s: None
local_sandbox-1 | 2026/08/04 11:12:17 GET /healthz -> 200 (0s)
ssrf_proxy-1 | 1785841937.917 120826 172.21.0.12 TCP_TUNNEL/200 2840 CONNECT n8n.hubplus.net:443 - HIER_DIRECT/104.21.94.192 -
api-1 | 2026-08-04 11:12:17.919 ERROR [Dummy-223] [sse_client.py:301] 35e9d59ff8bb59488d872706841e5cf9 - Error connecting to SSE endpoint
api-1 | Traceback (most recent call last):
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_transports/default.py", line 101, in map_httpcore_exceptions
api-1 | yield
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_transports/default.py", line 250, in handle_request
api-1 | resp = self._pool.handle_request(req)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpcore/_sync/connection_pool.py", line 256, in handle_request
api-1 | raise exc from None
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpcore/_sync/connection_pool.py", line 236, in handle_request
api-1 | response = connection.handle_request(
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpcore/_sync/http_proxy.py", line 343, in handle_request
api-1 | return self._connection.handle_request(request)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpcore/_sync/http11.py", line 136, in handle_request
api-1 | raise exc
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpcore/_sync/http11.py", line 106, in handle_request
api-1 | ) = self._receive_response_headers(**kwargs)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpcore/_sync/http11.py", line 177, in _receive_response_headers
api-1 | event = self._receive_event(timeout=timeout)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpcore/_sync/http11.py", line 231, in _receive_event
api-1 | raise RemoteProtocolError(msg)
api-1 | httpcore.RemoteProtocolError: Server disconnected without sending a response.
api-1 |
api-1 | The above exception was the direct cause of the following exception:
api-1 |
api-1 | Traceback (most recent call last):
api-1 | File "/app/api/core/mcp/client/sse_client.py", line 287, in sse_client
api-1 | with ssrf_proxy_sse_connect(
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/usr/local/lib/python3.12/contextlib.py", line 137, in __enter__
api-1 | return next(self.gen)
api-1 | ^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx_sse/_api.py", line 59, in connect_sse
api-1 | with client.stream(method, url, headers=headers, **kwargs) as response:
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/usr/local/lib/python3.12/contextlib.py", line 137, in __enter__
api-1 | return next(self.gen)
api-1 | ^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_client.py", line 868, in stream
api-1 | response = self.send(
api-1 | ^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_client.py", line 914, in send
api-1 | response = self._send_handling_auth(
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_client.py", line 942, in _send_handling_auth
api-1 | response = self._send_handling_redirects(
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_client.py", line 979, in _send_handling_redirects
api-1 | response = self._send_single_request(request)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_client.py", line 1014, in _send_single_request
api-1 | response = transport.handle_request(request)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_transports/default.py", line 249, in handle_request
api-1 | with map_httpcore_exceptions():
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/usr/local/lib/python3.12/contextlib.py", line 158, in __exit__
api-1 | self.gen.throw(value)
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_transports/default.py", line 118, in map_httpcore_exceptions
api-1 | raise mapped_exc(message) from exc
api-1 | httpx.RemoteProtocolError: Server disconnected without sending a response.
api-1 | 2026-08-04 11:12:17.925 ERROR [Dummy-223] [app.py:875] 35e9d59ff8bb59488d872706841e5cf9 - Exception on /console/api/workspaces/current/tool-provider/mcp/auth [POST]
api-1 | Traceback (most recent call last):
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_transports/default.py", line 101, in map_httpcore_exceptions
api-1 | yield
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_transports/default.py", line 250, in handle_request
api-1 | resp = self._pool.handle_request(req)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpcore/_sync/connection_pool.py", line 256, in handle_request
api-1 | raise exc from None
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpcore/_sync/connection_pool.py", line 236, in handle_request
api-1 | response = connection.handle_request(
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpcore/_sync/http_proxy.py", line 343, in handle_request
api-1 | return self._connection.handle_request(request)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpcore/_sync/http11.py", line 136, in handle_request
api-1 | raise exc
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpcore/_sync/http11.py", line 106, in handle_request
api-1 | ) = self._receive_response_headers(**kwargs)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpcore/_sync/http11.py", line 177, in _receive_response_headers
api-1 | event = self._receive_event(timeout=timeout)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpcore/_sync/http11.py", line 231, in _receive_event
api-1 | raise RemoteProtocolError(msg)
api-1 | httpcore.RemoteProtocolError: Server disconnected without sending a response.
api-1 |
api-1 | The above exception was the direct cause of the following exception:
api-1 |
api-1 | Traceback (most recent call last):
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/flask/app.py", line 917, in full_dispatch_request
api-1 | rv = self.dispatch_request()
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/flask/app.py", line 902, in dispatch_request
api-1 | return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args) # type: ignore[no-any-return]
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/flask_restx/api.py", line 404, in wrapper
api-1 | resp = resource(*args, **kwargs)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/flask/views.py", line 110, in view
api-1 | return current_app.ensure_sync(self.dispatch_request)(**kwargs) # type: ignore[no-any-return]
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/flask_restx/resource.py", line 41, in dispatch_request
api-1 | resp = meth(*args, **kwargs)
api-1 | ^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/controllers/console/wraps.py", line 336, in decorated
api-1 | return view(*args, **kwargs)
api-1 | ^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/libs/login.py", line 160, in decorated_view
api-1 | return current_app.ensure_sync(func)(*args, **kwargs)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/controllers/console/wraps.py", line 125, in decorated
api-1 | return view(*args, **kwargs)
api-1 | ^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/controllers/common/wraps.py", line 92, in decorated
api-1 | return view(*args, **kwargs)
api-1 | ^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/controllers/console/wraps.py", line 615, in decorated
api-1 | return view(self, current_tenant_id, *args, **kwargs)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/controllers/console/workspace/tool_providers.py", line 1497, in post
api-1 | with MCPClient(
api-1 | ^^^^^^^^^^
api-1 | File "/app/api/core/mcp/mcp_client.py", line 51, in __enter__
api-1 | self._initialize()
api-1 | File "/app/api/core/mcp/mcp_client.py", line 76, in _initialize
api-1 | self.connect_server(sse_client, "sse")
api-1 | File "/app/api/core/mcp/mcp_client.py", line 101, in connect_server
api-1 | streams = self._exit_stack.enter_context(streams_context)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/usr/local/lib/python3.12/contextlib.py", line 526, in enter_context
api-1 | result = _enter(cm)
api-1 | ^^^^^^^^^^
api-1 | File "/usr/local/lib/python3.12/contextlib.py", line 137, in __enter__
api-1 | return next(self.gen)
api-1 | ^^^^^^^^^^^^^^
api-1 | File "/app/api/core/mcp/client/sse_client.py", line 287, in sse_client
api-1 | with ssrf_proxy_sse_connect(
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/usr/local/lib/python3.12/contextlib.py", line 137, in __enter__
api-1 | return next(self.gen)
api-1 | ^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx_sse/_api.py", line 59, in connect_sse
api-1 | with client.stream(method, url, headers=headers, **kwargs) as response:
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/usr/local/lib/python3.12/contextlib.py", line 137, in __enter__
api-1 | return next(self.gen)
api-1 | ^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_client.py", line 868, in stream
api-1 | response = self.send(
api-1 | ^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_client.py", line 914, in send
api-1 | response = self._send_handling_auth(
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_client.py", line 942, in _send_handling_auth
api-1 | response = self._send_handling_redirects(
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_client.py", line 979, in _send_handling_redirects
api-1 | response = self._send_single_request(request)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_client.py", line 1014, in _send_single_request
api-1 | response = transport.handle_request(request)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_transports/default.py", line 249, in handle_request
api-1 | with map_httpcore_exceptions():
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/usr/local/lib/python3.12/contextlib.py", line 158, in __exit__
api-1 | self.gen.throw(value)
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/httpx/_transports/default.py", line 118, in map_httpcore_exceptions
api-1 | raise mapped_exc(message) from exc
api-1 | httpx.RemoteProtocolError: Server disconnected without sending a response.
nginx-1 | 172.21.0.1 - - [04/Aug/2026:11:12:17 +0000] "POST /console/api/workspaces/current/tool-provider/mcp/auth HTTP/1.1" 500 66 "https://dify.hubplus.net/integrations/tools/mcp" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" "14.232.106.132"
sandbox-1 | [GIN] 2026/08/04 - 11:12:23 | 200 | 221.705µs | ::1 | GET "/health"
local_sandbox-1 | 2026/08/04 11:12:47 GET /healthz -> 200 (0s)
sandbox-1 | [GIN] 2026/08/04 - 11:12:53 | 200 | 60.29µs | ::1 | GET "/health"
db_postgres-1 | 2026-08-04 11:13:05.065 UTC [27] LOG: checkpoint starting: time
db_postgres-1 | 2026-08-04 11:13:05.282 UTC [27] LOG: checkpoint complete: wrote 3 buffers (0.0%); 0 WAL file(s) added, 0 removed, 0 recycled; write=0.203 s, sync=0.006 s, total=0.217 s; sync files=3, longest=0.004 s, average=0.002 s; distance=6 kB, estimate=59 kB
```

### ✔️ Expected Behavior

- Should add new MCP server successfully

### ❌ Actual Behavior

- Cannot add new MCP server

Reproduce the failure in the self-hosted Docker setup through the MCP add flow, then inspect api/core/mcp/client/sse_client.py and the POST /console/api/workspaces/current/tool-provider/mcp/auth entry point. Compare the failing SSE connection and ssrf_proxy logs with the cloud behavior. Done means a self-hosted MCP server can be authorized and added without the RemoteProtocolError.

Written by the indexing model from the issue text.