Skip to main content
HTTP status: 400

​
Error message

​
When this error occurs

The platform connects as a public OAuth client using PKCE and only ever uses S256. The server advertised code_challenge_methods_supported without S256, so a connection can’t be established securely.

​
How to fix

  • The authorization server must support S256 PKCE (required by OAuth 2.1 and the MCP authorization spec). This is a server-side configuration issue — nothing to change on your end.
  • If the error notes tools are available without authorization, use the server open — add its URL to mcp_servers[] without a connection_id.