MCP HTTP 401 and 403: authorization and access checks
MCP returns HTTP 401 or 403? Distinguish endpoint authorization, account access, OAuth resource, scopes and Origin checks before changing permissions.
Identify the failing request first
Record whether the connection fails during initialization or only when accessing a file, repository or calendar. In the second case, MCP access may work while the underlying application rejects an operation. This distinction determines which authorization and permissions to inspect. Also record the time, client version and a sanitized error message. Remove token values from any shared log. A report that names the failed stage is much more useful than a screenshot containing only the status code.
HTTP 401: trace the authorization flow
First check the complete server URL and the response’s WWW-Authenticate challenge. Access to the provider’s ordinary API does not automatically authorize its MCP endpoint. The MCP authorization flow distinguishes the protected resource from the authorization server. Use the documented client flow and reconnect the intended account. Check locally whether access has expired or belongs to a different target resource. Do not send a token to an unrelated address merely to see whether it is accepted.
HTTP 403: permissions or request context
A 403 does not identify a single cause. Missing scopes are one possibility; organization policy, resource sharing and a rejected Origin are others. The transport specification requires a 403 for an invalid supplied Origin. Read the error and documented requirements before expanding permissions. For a resource access error, check the specific object the call needs. An account may be able to read one repository without being allowed to read every other repository in the same organization.
| Observation | Next check |
|---|---|
| 401 during initialization | Inspect endpoint and authorization challenge |
| 403 with a scope hint | Match required operation to permissions |
| 403 with an Origin hint | Check client origin and server allowance |
| Failure only inside a tool call | Inspect provider account and target resource |
Retest with bounded access
Choose a known test resource that the intended account is explicitly allowed to access. Check initialization first, then one small read operation. Record which change resolved the error. A successful login does not establish successful application access. Conversely, a missing resource is not automatically an authorization error. If the problem remains, provide the operator with the failing stage, time and sanitized request identifier if the service supplies one. Preserve the original configuration so the comparison remains reproducible.
Locate the error in initialization or an application operation.
Change only the authorization or access setting relevant to that error.
Repeat the bounded test and record its outcome.
Use the troubleshooting navigator for other symptoms and their next checks. The configuration builder helps compare formats. Use the registry comparison when similarly named entries declare different packages or launch paths. A registry declaration describes its source; it does not replace your connection test.
- Does a new token fix every 403?
- No. Organization policy, missing resource access or an Origin failure may remain unchanged.
- Should I grant every scope?
- Check the documented permissions for the required operation. Broadly expanding access makes the cause harder to isolate.
- Which details help diagnose an error?
- Provide the endpoint without secrets, time, client version, failing stage and sanitized request identifier.
- Does a successful login prove file access?
- No. The authorized account still needs access to the particular file or other target resource.
Sources checked on 1 October 2026. The checks are editorial suggestions for your environment.
- MCP 2025-11-25: Authorization
Show retrieval command
curl -s https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization - MCP 2025-11-25: Transports
Show retrieval command
curl -s https://modelcontextprotocol.io/specification/2025-11-25/basic/transports - MCP: Debugging
Show retrieval command
curl -s https://modelcontextprotocol.io/docs/tools/debugging