Four things that bit us shipping a remote MCP server with OAuth

We recently shipped a remote MCP server so people can verify email addresses from inside Claude, ChatGPT and Cursor. (Disclosure: I work on ClearBounce, the service behind it.) The protocol itself is pleasant to implement. What cost us time was everything around it — the parts that are not in the spec, or are in the spec but that clients and directories disagree about.

Here are four of them, with what we actually observed.

1. Echo the client's protocol version. Do not force your own.

Our initialize handler proudly returned the newest protocol version we supported. Claude Code refused to connect:

Server's protocol version is not supported: 2026-07-28

Four things that bit us shipping a remote MCP server with OAuth

Related reading

What it took to ship a production remote MCP server with OAuth 2.1

A pre-flight checklist for shipping a Claude connector

Building an MCP server so Claude can query my SaaS analytics directly

Adding a remote MCP server to a Next.js app, OAuth and all

What building a remote MCP server taught me about authentication

Seven ways a remote MCP server gets authorization wrong