When MCP is not working
Causes ordered by how often they turn out to be the real one, the edge-block diagnostic, and what to capture before escalating.
Work down this table. It is ordered roughly by how often each cause turns out to be the real one.
| What the user reports | Likely cause | Fix |
|---|---|---|
| ”Not a valid MCP server” or “the integration rejected the credentials”, and OAuth appeared to succeed | An edge bot-blocking rule is returning 403 to the AI vendor’s backend before the request reaches the platform. Browser sign-in works because it uses a normal user agent; the connector then calls with a bot user agent and is blocked | Edge configuration, not code. Run the diagnostic below and escalate with the result |
| Redirected to a pending-approval page | The AI client is not on the vendor allowlist and is awaiting review | Modero approves it. Send us the client’s name |
| Lists come back empty for everything | Your firm’s MCP / API module is off, or the user has no memberships | Check the partner module first. See Turning MCP on |
| ”Token is missing required scope: mcp:write” | The client was authorized read-only, or it carries a force read-only flag | Re-authorize, or ask us to clear the flag |
| ”This MCP client is restricted to read-only access” | A force read-only flag on the client | Ask us to clear it |
”<entity> is not available at your access level” | An organization-tier user reaching for partner-plane CRM data | Role change, not a plan change |
”crm is not enabled on your partner’s plan” | Your firm’s CRM module is off | Module change |
| ”MCP client is not approved” mid-session | The client was denied or revoked while connected | Re-approve, or the user re-authorizes a fresh client |
| Writes rejected with an unknown-field error | A field-name typo, or a protected or derived column | Ask the assistant to run fields_describe on that entity. See Changing data safely |
| A bandwidth edit “did not stick” | Direct bandwidth writes are refused precisely because the carrier sync reverts them | Use the change-order flow |
| Repeated re-login roughly hourly | A historical token-refresh bug, fixed, or a client that predates the fix | Remove and re-add the connector |
| Duplicate rows for one connector in the admin console | Each registration mints a new client ID | Expected. The console collapses them and actions fan out across the group |
The edge-block diagnostic#
This one is invisible from inside the platform, because the blocked request never reaches the application or its logs. It has to be diagnosed from outside.
curl -s -o /dev/null -w '%{http_code}\n' \
-H 'User-Agent: Claude-User/1.0' \
https://app.mymodero.com/api/mcp/mcpThen the same request with a normal user agent:
curl -s -o /dev/null -w '%{http_code}\n' https://app.mymodero.com/api/mcp/mcp401 from both is healthy: the request reached the application and it correctly demanded
authentication. 403 from the first and 401 from the second is a confirmed edge block, and the fix
is a rule exempting /api/mcp, /api/auth, and /.well-known from bot blocking.
Run the same pair against a branded host if the user connected through one.
What is visible in logs#
Every MCP request is logged with an action name: mcp.list, mcp.search, mcp.create, mcp.report,
and the OAuth handshake steps mcp.oauth.authorize_failed, mcp.oauth.consent_failed, and
mcp.oauth.token_failed.
A failure with no log line at all points to the edge block above rather than the application. That absence is itself the diagnostic.
Before escalating#
Capture these. Items 1, 4, and 6 resolve the large majority of reports on their own.
- The exact error text, and where it appeared: the AI client’s UI, the browser, or the consent screen.
- The client and version: Claude web, Claude Desktop, Claude Code, ChatGPT, Gemini, or other.
- The host they connected to.
- Their role and organization, and the advisory firm above it.
- Whether the AI client shows as approved.
- The result of the two curl commands above.
- A rough timestamp, so logs can be searched on the
mcp.action prefix.
Send it through Reporting a bug.
Related guides
- Turning MCP on The four things that must all be true before an assistant returns any data, in the order to check them.
- Connecting an assistant The server address, the setup steps for Claude, Claude Code, ChatGPT and Gemini, and what to expect from the consent screen.
- Reporting a bug What to include so we can reproduce it on the first try.
Last reviewed September 3, 2026.
Something wrong or missing? Tell us or contact support.