Troubleshooting
Fixes for the most common connection problems.
Start with Settings, Connect AI: it shows each connected app and when it last made a request. If an app never shows up, the sign-in did not finish.
The assistant says it could not reach the server
Check the address is exactly the one in Connect AI, including /mcp and https. Assistants such as Claude and ChatGPT connect from their own cloud, so a VPN or a local address will not work.
The consent page says the redirect address is not registered
The assistant used a callback address that your client does not list. With a client from Settings, add the exact address (shown by the assistant) to the client. With automatic registration this should not happen; remove the connector and add it again.
"This app was created by a different account"
A client made in Settings can only be used by the account that created it. Sign in with that account, or let the assistant register itself.
invalid_client after it worked before
The client was removed, or its secret was regenerated (which also signs every app out). Paste the new secret, or reconnect.
invalid_grant or it asks you to sign in again
Refresh tokens last 30 days and work once. If two copies of the assistant refresh at the same time, one fails; reconnect. Also happens after you disconnect the app in Settings.
It cannot start or stop scans
The app was connected with read-only permission. Disconnect it in Settings, Connect AI, then connect again and keep "Allow starting and stopping scans" on.
Starting a scan fails with a conflict
A scan is already queued or running for that site. Ask for its status, or stop it first.
The assistant sees no sites or no data
It sees only the account you signed in with on the consent page. Check which account that was, and that the site has finished a scan.
Too many requests
See Limits and fair use: 120 requests per minute per connection.
Checking the server by hand
- Without a token the server must answer 401 with a
WWW-Authenticateheader that points at/.well-known/oauth-protected-resource/mcp. /.well-known/oauth-authorization-serverlists the sign-in endpoints andS256as the only PKCE method.