Spent a while last month trying to work out why our hosted MCP server was listed on two directories and both showed zero tools. The server worked fine in Claude, Cursor, everywhere. Turned out to be a one-line assumption in our auth middleware, and I don't think we're the only ones making it, so here's the writeup.
The setup. Remote streamable-HTTP MCP server. Auth is a Bearer token. The middleware did the obvious thing: no Authorization header → 401 + WWW-Authenticate pointing at our OAuth protected-resource metadata. That's correct per the spec, and it's what makes MCP clients kick off the OAuth flow instead of just failing. Felt clean.
The problem. Registry scanners don't authenticate. They send an anonymous initialize and tools/list and record whatever comes back. A blanket 401 means they record nothing. Smithery listed us with "0 capabilities". Glama had us Healthy with 16 tools at one point, then flipped to Unhealthy, and I'd assumed that was a flaky probe on their end. It wasn't. It was us, and it had been us the whole time.
The part that stung: every artifact we publish points scanners at that endpoint. The server.json in the MCP Registry, the README, our docs, the config snippet people copy-paste. All of them aimed straight at the endpoint that answered "Unauthorized" to anyone who hadn't signed up yet. We'd been telling the ecosystem "here are our tools" while the endpoint said nothing at all.
The fix, which is small once you see it: gate on the request, not the connection.
Only `tools/call` for a privileged tool needs a Bearer. `initialize`, `tools/list`, and calls to public tools answer anonymously. Concretely, ours became:
function requiresAuth(body) { const messages = Array.isArray(body) ? body : [body] return messages.some((m) => { if (m?.method !== 'tools/call') return false const name = m?.params?.name return typeof name !== 'string' || !name.startsWith(FREE_TOOL_PREFIX) }) } Note it handles a batched array. JSON-RPC lets clients send one, and if you only check body.method a batch slips through as undefined.
The bit worth arguing about: doesn't this expose something? It didn't for us, and I'd check whether it does for you before copying this. Our server builds its tool set from the token: no token means only the public read-only tools ever get registered, so the anonymous path could never have reached a privileged tool even when it was 401ing. The 401 was theatre in front of a boundary that already existed one layer down. If your server registers everything up front and relies on the middleware as the only gate, then this change is a real exposure and you want to fix the registration first.
Also worth checking while you're in there, because it's the same class of bug: GET on your MCP endpoint should return 405, not 404. Streamable HTTP says a server with no SSE stream to offer on GET answers Method Not Allowed. Express's default 404 reads as "host is down" to health checkers. That one cost us an Unhealthy badge a couple of weeks earlier and I fixed it without understanding it was the same shape of problem.
Result. After deploying, Smithery rescanned and found 16 tools, quality score went 28 → 52 → 80. Glama went back to Healthy on its next probe. Same server, same tools, one predicate.
How to check yours in ten seconds, no key, works against any remote MCP server:
curl -s https://your-mcp-host/mcp \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' If that returns a 401 instead of your tool list, the directories are seeing exactly what you just saw.
For context, ours is Domainee, a custom domains API for SaaS, so the MCP tools are things like "connect this customer's hostname and give me the CNAME to hand them" plus a set of free keyless DNS/SSL diagnostic tools. Repo with the full tool list is at github.com/CommonNinja/domainee-mcp-server if you want the concrete version of any of the above.
Curious whether anyone's found a directory that does authenticate when it scans. As far as I can tell they all probe anonymously, which makes "anonymous discovery works" a hard requirement for being listed at all, and I haven't seen that written down anywhere in the spec.
Source: r/mcp · by /u/dsternlicht