claude.ai makes two discovery requests before the MCP handshake. Both were returning 404, causing "Couldn't reach the MCP server."
Changes
GET /.well-known/oauth-protected-resource → 200 {"authorization_servers":[]} — signals no OAuth required (RFC 9728)
GET /.well-known/oauth-authorization-server → 404 — explicit, no auth server present
HEAD /mcp → 200 + MCP-Protocol-Version: 2025-06-18 header
No new dependencies. Test added for the HEAD handler.
Acceptance criteria
GET /.well-known/oauth-protected-resource returns 200 with valid JSON
HEAD /mcp returns 200 with MCP-Protocol-Version: 2025-06-18
All existing tests pass
Fixes #2.
## What
claude.ai makes two discovery requests before the MCP handshake. Both were returning 404, causing "Couldn't reach the MCP server."
## Changes
- `GET /.well-known/oauth-protected-resource` → 200 `{"authorization_servers":[]}` — signals no OAuth required (RFC 9728)
- `GET /.well-known/oauth-authorization-server` → 404 — explicit, no auth server present
- `HEAD /mcp` → 200 + `MCP-Protocol-Version: 2025-06-18` header
No new dependencies. Test added for the HEAD handler.
## Acceptance criteria
- [x] `GET /.well-known/oauth-protected-resource` returns 200 with valid JSON
- [x] `HEAD /mcp` returns 200 with `MCP-Protocol-Version: 2025-06-18`
- [x] All existing tests pass
Implements RFC 9728 protected resource metadata and HEAD probe so
claude.ai can complete its pre-handshake discovery without hitting 404.
- GET /.well-known/oauth-protected-resource → 200 {"authorization_servers":[]}
- GET /.well-known/oauth-authorization-server → 404 (no auth server)
- HEAD /mcp → 200 + MCP-Protocol-Version: 2025-06-18 header
Closes#2
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
mathias
merged commit 4f0f65e26a into main2026-05-06 15:20:58 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #2.
What
claude.ai makes two discovery requests before the MCP handshake. Both were returning 404, causing "Couldn't reach the MCP server."
Changes
GET /.well-known/oauth-protected-resource→ 200{"authorization_servers":[]}— signals no OAuth required (RFC 9728)GET /.well-known/oauth-authorization-server→ 404 — explicit, no auth server presentHEAD /mcp→ 200 +MCP-Protocol-Version: 2025-06-18headerNo new dependencies. Test added for the HEAD handler.
Acceptance criteria
GET /.well-known/oauth-protected-resourcereturns 200 with valid JSONHEAD /mcpreturns 200 withMCP-Protocol-Version: 2025-06-18Implements RFC 9728 protected resource metadata and HEAD probe so claude.ai can complete its pre-handshake discovery without hitting 404. - GET /.well-known/oauth-protected-resource → 200 {"authorization_servers":[]} - GET /.well-known/oauth-authorization-server → 404 (no auth server) - HEAD /mcp → 200 + MCP-Protocol-Version: 2025-06-18 header Closes #2 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>