MCP Tip: Blanket 401 on tools/list Makes Every Directory Show 0 Capabilities
dsternlicht · reddit · 2026-09-17
A developer debugs why their hosted MCP server showed "0 capabilities" on Smithery and flapped Unhealthy on Glama: the auth middleware 401'd anonymous requests per spec, but registry scanners don't authenticate — they anonymously call initialize and tools/list and record nothing.
Fix: gate on the request, not the connection —
- Answer initialize, tools/list, and calls to public tools anonymously; require Bearer only for privileged tools/call.
- Handle JSON-RPC batched arrays; checking only body.method lets batches slip through.
Security caveat: safe if tools are registered per-token (anonymous path only ever sees public read-only tools); a real exposure if all tools are registered up front and the middleware is the only gate.
Same-class bug: GET on the MCP endpoint should return 405, not 404, or health checks read the host as down.
Result: Smithery rescanned and found 16 tools, quality score 28 → 52 → 80; Glama went back to Healthy. Includes a ten-second keyless curl self-check.
More from coding & agent
- Dev Runs Fully Autonomous Agent Teams: It Works End-to-End, But Not Reliable At All — MoonL88537 · 2026-09-17
- GitHub MCP maintainer demos Pi-MCP fork with progressive disclosure and tool-call checkpoints — marlene_zw · 2026-09-17
- QOJ publishes list of contest problems where GPT-6 Pro found solutions beating the authors' — teortaxesTex · 2026-09-17
- What Happens After You Tell an AI Agent It's Wrong? Dreamforce Enterprise Lessons — TheTuringPost · 2026-09-17
- GitHub MCP maintainer packs the house at MCPCon with talk "MCP doesn't have a context problem" — marlene_zw · 2026-09-17
- Label the Row: A Six-Step Data Classification Cheat Sheet for AI Products — blaizedsouza · 2026-09-17