MCP OAuth Connect

com.gfbytesPublished by gfbytes.comOfficial publisherv0.2.0Updated Oct 24, 2026

Ping-only MCP origin for claude.ai, Desktop, Cursor, and Grok Connectors.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A remote, OAuth-protected ping-only MCP reference endpoint from GFB, meant for testing whether MCP clients can complete a connector handshake.

What you can do
Connect an assistant to a ping-only reference MCP origin at a fixed remote address, with no tools listed in the manifest and no declared tool set to call beyond a basic ping-style check. Serve as a demo endpoint for claude.ai, Desktop, Cursor and Grok Connectors when checking whether a remote MCP answers curl but fails inside a client. Pair with a separate stdlib Python diagnostic script that reads discovery metadata and reports on login challenge, registration endpoint, PKCE S256 and protected-resource metadata, exiting 0 or 1 with a JSON report. Optionally be installed as a Claude Code or Grok Build plugin that runs the same diagnostic path.
When to use it
Use it when you want a known, ping-only remote MCP endpoint to test whether a client or connector can reach and authenticate against a remote MCP server, or when debugging why a remote MCP works with curl but fails in Claude, Cursor, Desktop or Grok Connectors.
Requirements
A remote endpoint at the provider's MCP host, reachable over the network, with OAuth authentication required. The diagnostic script needs Python 3.10 or later using only the standard library; tests need pytest. No environment variables or headers are declared.
Before you install
The endpoint is explicitly ping-only and is not a hosted MCP product or a completed handshake; the checker reads discovery metadata only and does not perform dynamic client registration, mint tokens or call tools. A failed check is described as a scoping signal, not a dead end. The README notes a separate paid attach lab on the studio product page, so do not confuse the free checker with that paid offering.

Installation

In SourceWeft

  1. Open MCP OAuth Connect in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.gfbytes%2Fmcp-oauth-connect/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "oauth-connect": {
      "type": "http",
      "url": "https://mcp.gfbytes.com/mcp"
    }
  }
}

README

MCP OAuth Connect

[tests]

Free checker for when an MCP remote answers curl but dies in Claude / Cursor / Desktop / Grok Connectors.

Live checkercheck.gfbytes.com
This repoCLI diagnose.py + plugin / skill
Web UImcp-gfbytes
Demo MCPhttps://mcp.gfbytes.com

Part of GFB's lab surface. Founder / peer identity: gregfredabytes.com · essay · what I run

[Diagnose output]

What this is not

  • Not a hosted MCP product. https://mcp.gfbytes.com is a ping-only reference server.
  • Not a completed handshake. The checker reads discovery metadata. It does not do DCR, mint a token, or call tools/list. A fail is a scoping signal, not a dead end.
  • Not the paid attach lab. Four-client attempt + written path lives on the studio product page.

Paste only the URL in a Connectors UI — no API key.

Clone / run

Stdlib Python ≥3.10. No install for the checker:

bash
git clone https://github.com/GFB2026/mcp-oauth-connect.gitcd mcp-oauth-connectpython skills/mcp-oauth-connect/scripts/diagnose.py https://mcp.gfbytes.com

Exit 0 if connector-critical checks pass; 1 otherwise. JSON report on stdout.

Looks for a proper login challenge (not a bare 200 from curl), a registration endpoint, PKCE S256, and RFC 9728 protected-resource metadata.

Tests:

bash
python -m pip install "pytest>=8"python -m pytest

For AI assistants / contributors

Edit lanes and hard stops: .github/copilot-instructions.md. Verify with python -m pytest (install pytest>=8; this tree is flat — no pip install -e).

Plugin install (optional)

Claude Code:

text
/plugin marketplace add GFB2026/mcp-oauth-connect/plugin install mcp-oauth-connect@mcp-oauth-connect

Grok Build:

text
grok plugin marketplace add GFB2026/mcp-oauth-connectgrok plugin install mcp-oauth-connect --trust

Then run the same diagnose.py path as above.

template/

Public ping-only example behind https://mcp.gfbytes.com (MIT). Reference server, not a service SKU.

License

MIT for the plugin, skill, diagnose script, tests, and template/. Studio attach-lab / fix-round services are separate offers on gfbytes.com.

Source: README.md at commit 2673411

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

1
  1. v0.2.0LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts