Skip to main content
When MCP Manager cannot connect to a remote MCP server, the add-server dialog and the alert it raises name one of the causes below. Each section says how to confirm it and what to change. The links in the dialog and the alert open the matching section.
Most of these failures happen before the request reaches the MCP server. Something in front of the server answered instead, or nothing answered at all. That is why the fix is often on the server provider’s side, not in MCP Manager.

​
A firewall blocked MCP Manager

A web application firewall (WAF) in front of the server refused MCP Manager’s request outright. With Cloudflare this is the page titled Attention Required! | Cloudflare that says Sorry, you have been blocked, returned with HTTP 403. A block does not clear on its own. It usually means the firewall treats requests from cloud data-centre addresses as bots. The server may still work from your own browser or from another AI client, because their requests come from different addresses. What to do: ask the server’s provider to let MCP Manager through. Send them:
  • MCP Manager’s outbound IP addresses. They are listed in MCP Manager under Settings > Security > IP addresses, and published at app.mcpmanager.ai/enterprise/ip-ranges (JSON). Use the addresses marked egress.
  • The Ray ID shown in the alert or the dialog. The provider can look it up in Cloudflare under Security > Events to see which rule blocked the request.
  • The path of the MCP endpoint, for example /mcp.
A rule scoped to the MCP endpoint is the narrowest fix. In Cloudflare, a custom rule with the action Skip and an expression such as:
The skip must target the product that blocked the request: WAF managed rules, a custom rule, or bot protection. Cloudflare’s Bot Fight Mode cannot be skipped by a custom rule on Free and Pro plans. If the endpoint is meant to be public, skipping bot protection for that path for everyone also works, and helps every AI client, not just MCP Manager.
Allowing an IP address lets MCP Manager’s traffic reach the server. It is not authentication: the address is shared by MCP Manager, not specific to your workspace. Keep any authentication the server requires.

​
Bot protection challenged MCP Manager

Bot protection (a Cloudflare managed challenge, or an AWS WAF challenge or captcha) answered MCP Manager’s request with a human-verification page instead of an MCP response. Unlike a block, a challenge often clears on its own after a short while. What to do: wait a few minutes and retry. If it keeps happening, ask the provider to exempt the MCP endpoint from bot challenges, or to allow MCP Manager’s egress IP addresses, as described in A firewall blocked MCP Manager.

​
MCP Manager could not reach the server

The address did not answer, or the connection failed before any response arrived: the hostname does not resolve, the port is closed, the connection timed out, or the TLS handshake failed. What to do:
  1. Check the URL for typos, and that it includes the scheme (https://).
  2. Confirm the server is reachable from the public internet, not only from your network or VPN. MCP Manager connects from its own addresses.
  3. If the server only accepts traffic from known addresses, allowlist MCP Manager’s egress IP addresses.
  4. For a server on your own machine or private network, connect it as a workstation server instead.

​
The server did not answer the first MCP request

The server responded, but with an error or a web page instead of an MCP response to initialize, the first request every MCP client sends to start a session. What to do:
  1. Check that the URL points at the MCP endpoint itself (often ending in /mcp), not the provider’s website, documentation, or API root.
  2. Open the alert’s Debug Context. It shows the HTTP status and the start of the response body, which usually names the problem.
  3. If the response is an HTML page from a firewall or bot protection, see the first two sections above.

​
Authentication could not be detected

MCP Manager found no sign of how to authenticate: the server published no OAuth metadata, and it did not accept an unauthenticated connection. What to do:
  • If the provider gave you a token or API key, add the server with custom headers instead. See Choosing a remote authentication method.
  • If the provider gave you an OAuth client ID and secret, use OAuth with client pre-registration. See Remote servers.
  • If the server should be open, check that it answers initialize with HTTP 200. A firewall answering 403 can look like an authentication requirement; see A firewall blocked MCP Manager.

​
Further reading

Fixing broken connections

Reconnect a server whose credentials stopped working.

Alerts

What each alert means and what to do about it.