MCP error reference
Look up the error your client printed, and fix it.
Find your error
Paste the string your client printed. Search also matches other wordings clients use for the same cause.
13 results
One parameter in that tool's inputSchema carries an x-mcp-header annotation that breaks a 2026-07-28 constraint, so a conforming Streamable HTTP client drops the whole tool from tools/list and logs a warning instead of raising an error.
5 other strings clients print for this
- [mcp-sdk] excluding tool '<name>' from tools/list: invalid x-mcp-header declaration — <reason>
- [mcp-sdk] tool '<name>' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: <reason>
- dropping tool '<name>': invalid x-mcp-header (<reason>)
- <path>: x-mcp-header is only permitted on primitive-typed properties (string, integer, boolean); got <type>
- <path>: x-mcp-header is only permitted on properties statically reachable via a chain of 'properties' keys (not under items, additionalProperties, oneOf/anyOf/allOf/not, if/then/else, or $ref)
Authorization with the MCP server failed
See the fixThe client says it is connected, but no usable credential reaches your server: either it doesn't attach the token, or the token carries an audience your server is right to reject.
6 other strings clients print for this
- Authorization with the MCP server failed. You can check your credentials and permissions. If this persists, share this reference with support: "ofid_..."
- UnauthorizedError: Unauthorized
- {"error":"invalid_token","error_description":"Authentication required"}
- Missing Authorization header
- AADSTS9010010
- invalid_target
Couldn't reach the MCP server
See the fixOne toast covers four different failures: a claude.ai connector reaches your server from Anthropic's infrastructure over the public internet rather than from your machine, so the request dies at whichever hop exists only on that path — DNS, your edge, a redirect, or OAuth discovery.
5 other strings clients print for this
- Authorization with the MCP server failed
- Works in Claude Code or curl but not claude.ai
- works in MCP Inspector or Claude Code CLI but not claude.ai
- Custom connector "Couldn't reach the MCP server" — zero inbound traffic at edge, server verified reachable
- AADSTS9010010 (sometimes surfaced as invalid_target)
Dynamic Client Registration not supported
See the fixThe MCP client reached your authorization server's metadata and found no way to obtain a client ID — no registration endpoint, no Client ID Metadata Document support, and none configured in the client — so it stopped before the OAuth flow began.
6 other strings clients print for this
- Incompatible auth server: does not support dynamic client registration
- The authorization server '<url>' does not support automatic client registration. Do you want to proceed by manually providing a client registration (client ID)?
- Automatic client registration isn't supported by <connector>. Edit the connector and add an OAuth Client ID.
- Couldn't register with <connector>'s sign-in service. You can try again, or add an OAuth Client ID in the connector settings.
- Dynamic client registration failed: HTTP 422
- {"error":"invalid_client_metadata","error_description":"Dynamic registration is not available for this client."}
The client knows which authorization server to use, but none of the well-known URLs it probes returned a metadata document, so it never learns where /authorize and /token are and the flow stops short of a login.
5 other strings clients print for this
- Error populating auth server metadata for <issuer>: AggregateError: Failed to fetch authorization server metadata from all attempted URLs
- Failed to fetch authorization server metadata from <url>: <status> <body>
- Failed to authenticate with MCP server '<name>': Failed to fetch authorization server metadata for client registration (attempted issuers: <urls>)
- HTTP <status> trying to load OpenID provider metadata from <url>
- failed to fetch authorization server metadata: failed to fetch metadata from any authorization server
Your credential never reaches the wire: the client found OAuth discovery metadata on the server first and started the OAuth flow instead of sending the header you configured.
5 other strings clients print for this
- [Bug] MCP Server Authorization Header Not Recognized, Falls Back to OAuth
- it refuses to obey an Authorization header now and tries to use oauth
- .mcp.json ignores headers field for HTTP MCP servers
- MCP server with basic auth headers works in user mcp.json but triggers OAuth flow when configured via extension .mcp.json
- Error: HTTP 403: Invalid OAuth error response: SyntaxError: JSON Parse error: Unrecognized token '<'.
mcp_authentication_failed_error
See the fixA managed agent's connection to your MCP server failed on authentication: the server rejected the credential from the attached vault, required authentication when no matching credential was configured, or an mcp_oauth token refresh failed.
3 other strings clients print for this
- Authentication with the MCP server failed: the server rejected the credential from the attached vault, required authentication when no matching credential was configured, or an OAuth token refresh failed.
- vault_credential.refresh_failed
- {"error":"invalid_token"}
Your server code imports mcp.server.fastmcp, but the installed mcp package is 2.x, where that module no longer exists — so the process dies at import, before it speaks any MCP.
3 other strings clients print for this
- MCP error -32000: Connection closed
- Failed to reconnect to plugin:<plugin>:<server>: -32000
- AttributeError: 'Server' object has no attribute 'list_tools'
resource indicator is missing, or unknown
See the fixYour authorization server refused to bind a token to your MCP server — the resource value it was handed names something it does not recognize, or the client sent none and this server requires one — so no token is minted and nothing ever reaches your MCP server.
6 other strings clients print for this
- Authorization error: InvalidTargetError: resource indicator is missing, or unknown
- AADSTS9010010: The resource parameter provided in the request doesn't match with the requested scopes.
- AADSTS901002: The 'resource' request parameter is not supported.
- {"error":"invalid_target","error_description":"apps scopes require a valid MCP resource"}
- Error getting token from server metadata: ServerError: invalid_target
- Missing or invalid grant_type, code, redirect_uri, client_id, PKCE (code_verifier), or resource required
Your server answers 401 correctly, but the response carries no pointer to protected resource metadata, so the client cannot discover the authorization server and the OAuth flow never starts.
4 other strings clients print for this
- Could not fetch resource metadata
- No authorization_servers found in resource metadata <url> - Is this resource metadata configured correctly?
- Protected resource <advertised> does not match expected <dialed>
- Failed to start OAuth flow for <server>: SDK auth failed: Protected resource <advertised> does not match expected <dialed> (or origin)
AWS recomputed the signature over the request it actually received, got a different value from the one you sent, and answered 403 before your MCP server ran — so nothing about your tools, your handler, or your IAM policy is implicated yet.
7 other strings clients print for this
- SignatureDoesNotMatch
- Credential should be scoped to correct service: '<service>'
- Credential should be scoped to a valid Region, not <region-code>
- Signature expired: <date> is now earlier than <date>
- Signature not yet current: <date> is still later than <date>
- Date in Credential scope does not match YYYYMMDD from ISO-8601 version of date from HTTP
- The signature contains an invalid key=value pair (missing equal-sign) in Authorization header
Token audience validation failed
See the fixThe token is real — right issuer, good signature, not expired — but the aud claim names something other than this MCP server, so the server is required to reject it.
4 other strings clients print for this
- invalid audience
- Token audience validation failed - no matching audiences
- Token resource validation failed. Expected: <resource>
- The aud claim is not valid
A gate in front of your MCP server is enforcing login built for humans in browsers, so an unauthenticated client gets a login page, a redirect, or a bare 403 instead of the 401 that would tell it where to authenticate.
3 other strings clients print for this
- MCP client gets HTML instead of JSON
- Unexpected token '<', "<!DOCTYPE "... is not valid JSON
- MCP server connection failed, received 403 Forbidden
Set up authentication correctly
Stop debugging auth on every MCP server
A gateway in front of your MCP servers handles discovery, audience binding, and token validation once — for every server and every client.