At a glance
- Find the first failed requestLook at the server log for the first POST from the client (the `initialize` call).
- Check the OAuth setupOn a 401 the server should send `WWW-Authenticate` pointing to its protected-resource metadata at `/.well-known/oauth-protected-resource`.
- Test outside the automation toolRun the MCP Inspector (`npx @modelcontextprotocol/inspector`), choose Streamable HTTP and the same URL.
Find the first failed request
- Look at the server log for the first POST from the client (the `initialize` call).
- Note its status and whether an `Authorization: Bearer` header was present.
Check the OAuth setup
- On a 401 the server should send `WWW-Authenticate` pointing to its protected-resource metadata at `/.well-known/oauth-protected-resource`.
- That metadata should name the authorization server.
- The token's audience or resource must match the MCP URL exactly, path included.
Test outside the automation tool
- Run the MCP Inspector (`npx @modelcontextprotocol/inspector`), choose Streamable HTTP and the same URL.
- If it connects and lists tools, the server is fine. Send the tool's support the request IDs from the failing attempt.
- If it fails too, the server log from step one shows where.
Updated 2026-11-01. General guidance, not advice for your situation; we scope each project in writing before any work starts.
Questions people ask first
Is a 405 on GET a bug?
No. A server that doesn't offer a standalone event stream may answer GET with 405, and clients should accept it.
Do I need a proxy?
Usually not. Fix the authentication on the first POST and the fallback never runs.
Tell us what you need built.
Tell us the process and the tools involved, or call. We reply with questions or a written scope.
hello@pushbuild.com