The Streamable HTTP GET handler returned 401 unconditionally. This server is
stateless and offers no server-initiated SSE stream, for which the MCP
Streamable HTTP spec requires 405 Method Not Allowed.
Returning 401 made spec-compliant clients (Claude connector, Claude Desktop,
Cursor) treat the SSE GET as an auth failure and enter a refresh-token →
re-open-GET → 401 retry loop. Across the active connector base this storms
/api/extensions/ext/mcp-server/mcp (observed ~steady GET→401 traffic on
app.gnubok.se) and churns OAuth API-key rotation — and tripped a Vercel
usage anomaly (edge requests + function invocations spiking ~16x).
OAuth discovery remains bootstrapped on the POST 401 (WWW-Authenticate +
.well-known/oauth-protected-resource); the POST JSON-RPC channel and the
POST-only npm bridge are unaffected.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Jakob Wennberg
7aa37fd3b8