Client continuously sends requests after server restart, causing 401 Unauthorized

Describe the bug
When running mcp-server and auth-server with npm run dev:with-separate-auth, the connection works successfully at first. However, after the server restarts, the client (Cursor) keeps sending repeated requests to the mcp-server and receives 401 Unauthorized responses. Once the server replies with Too Many Requests, the requests stop.

To Reproduce
Steps to reproduce the behavior:

Start mcp-server and auth-server with npm run dev:with-separate-auth.

Confirm that the connection is established successfully.

Restart the server.

Observe that the client (Cursor) keeps sending requests to the mcp-server, resulting in 401 Unauthorized responses until the server eventually responds with Too Many Requests.

Expected behavior
After the server restarts, the client should refresh/re-establish a valid session/token instead of continuously sending unauthorized requests.

Logs
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/.well-known/oauth-protected-resource/mcp","headers":{"user-agent":"node","mcp-protocol-version":"2025-06-18","accept":"/"},"userAgent":"node","path":"/.well-known/oauth-protected-resource/mcp","msg":"Request received","time":"2025-09-30T07:49:01.729Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/.well-known/oauth-protected-resource/mcp","statusCode":404,"duration":"1ms","userAgent":"node","path":"/.well-known/oauth-protected-resource/mcp","msg":"Request completed","time":"2025-09-30T07:49:01.730Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/.well-known/oauth-protected-resource","headers":{"user-agent":"node","mcp-protocol-version":"2025-06-18","accept":"/"},"userAgent":"node","path":"/.well-known/oauth-protected-resource","msg":"Request received","time":"2025-09-30T07:49:01.731Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/","statusCode":200,"duration":"0ms","userAgent":"node","path":"/.well-known/oauth-protected-resource","msg":"Request completed","time":"2025-09-30T07:49:01.731Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/mcp","headers":{"user-agent":"Cursor/1.7.17 (darwin arm64)","mcp-protocol-version":"2025-06-18","mcp-session-id":"bb9e7729-527a-41bf-8176-47079a0364a6","accept":"text/event-stream"},"userAgent":"Cursor/1.7.17 (darwin arm64)","path":"/mcp","msg":"Request received","time":"2025-09-30T07:49:01.743Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":20,"token":"b99bfaf8...","cacheDuration":"60s","userAgent":"Cursor/1.7.17 (darwin arm64)","method":"GET","path":"/mcp","msg":"Token validation cached","time":"2025-09-30T07:49:01.747Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":20,"method":"GET","sessionId":"bb9e7729-527a-41bf-8176-47079a0364a6","userId":"47548bff-02ad-44ec-a6fc-25fc7bb925a7","hasAuth":true,"authExtra":{"userId":"47548bff-02ad-44ec-a6fc-25fc7bb925a7","iss":"http://localhost:3001","aud":"http://localhost:3232"},"userAgent":"Cursor/1.7.17 (darwin arm64)","path":"/mcp","msg":"SHTTP request received","time":"2025-09-30T07:49:01.749Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":20,"sessionId":"bb9e7729-527a-41bf-8176-47079a0364a6","userAgent":"Cursor/1.7.17 (darwin arm64)","method":"GET","path":"/mcp","msg":"Session not live","time":"2025-09-30T07:49:01.749Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":40,"sessionId":"bb9e7729-527a-41bf-8176-47079a0364a6","userId":"47548bff-02ad-44ec-a6fc-25fc7bb925a7","requestMethod":"GET","userAgent":"Cursor/1.7.17 (darwin arm64)","method":"GET","path":"/mcp","msg":"Session ownership mismatch","time":"2025-09-30T07:49:01.749Z","v":0}
{"name":"mcp-server-everything","hostname":"MacBook-Mtx.local","pid":25838,"level":30,"method":"GET","url":"/mcp","statusCode":401,"duration":"7ms","userAgent":"Cursor/1.7.17 (darwin arm64)","path":"/mcp","msg":"Request completed","time":"2025-09-30T07:49:01.750Z","v":0}

Additional context

This issue only happens after a server restart. The initial connection works without issues.

The client is Cursor, which connects to the mcp-server.

Commencez par reproduire le problème avec npm run dev:with-separate-auth, puis examinez la requête MCP ainsi que la gestion de l’authentification et de la session représentées dans les logs. Vérifiez le comportement après un redémarrage du serveur, notamment la session invalide et les réponses 401 répétées ; le travail est terminé lorsque le client actualise ou rétablit une session valide au lieu de réessayer jusqu’à atteindre la limite de débit.