If your MCP server uses OAuth, every directory thinks it has zero tools

When an MCP server utilizes OAuth 2.1 authentication, directories fail to recognize it as having any tools attached. This results in every directory listing the server as possessing zero tools, regardless of the server's actual tool capabilities. Although the server may have four operational tools, this information is concealed from users and directories.

This issue arises due to the nature of the tools/list JSON-RPC method, which requires a user for each call, leading to a 401 Unauthorized response when called without an authenticated user. The directory crawler encounters this error and records the server as having no tools. The consequence is that the server remains invisible to users browsing for servers, despite its actual functionality.

The fix involves separating the public methods that directories can access without authentication, such as tools/list, from the authenticated methods that require access to user data or credits. By implementing a specific set of checks for public requests and ensuring only authenticated requests access privileged methods, directories can accurately reflect the server's tool capabilities.