claude-code - 💡(How to fix) Fix Streamable HTTP MCP: auth requirement should be based on 401 response, not well-known endpoint discovery [2 comments, 2 participants]

• Server responds 200 to MCP initialize request (no Bearer token required)
• /.well-known/oauth-authorization-server returns metadata
• Claude Code displays "needs authentication"

TL;DR

Modify Claude Code to only trigger the OAuth flow when the server responds with a 401 Unauthorized status code to an MCP request.

Guidance

• Review the Claude Code authentication logic to ensure it checks the server's response status code before initiating the OAuth flow.
• Update the code to send the MCP request without authentication first and only trigger the OAuth flow if the server responds with a 401 status code.
• Verify that the server's /.well-known/oauth-authorization-server endpoint is not being used as the sole indicator for authentication requirement.
• Test the updated code with a server that exposes OAuth metadata endpoints but accepts unauthenticated requests to ensure the correct behavior.

Example

// Pseudo-code example of the updated authentication logic
if (serverResponse.statusCode == 401) {
  // Trigger OAuth flow
} else {
  // Proceed with the request without authentication
}

Notes

The current implementation of Claude Code may cause unnecessary authentication prompts when connecting to servers that expose OAuth metadata endpoints but do not require authentication for certain requests.

Recommendation

Apply workaround: Update the Claude Code authentication logic to follow the MCP spec and only trigger the OAuth flow when the server responds with a 401 Unauthorized status code. This ensures that the OAuth flow is only initiated when necessary, providing a better user experience.