Customer report
Claude Desktop via [email protected] → https://worldmonitor.app/mcp: initialize + tools/list + resources/list respond ~500ms, but prompts/list (id=2) never gets a response; after the 30s timeout the client sends notifications/cancelled, marks the server unstable, and refuses all subsequent tools/call.
Root cause (reproduced live + E2E via [email protected])
initialize is public and succeeds anonymously → mcp-remote never receives a 401 challenge at connect → never runs OAuth → session stays anonymous.initialize advertises prompts + logging capabilities to that anonymous session.prompts/list is NOT in PUBLIC_MCP_METHODS (api/mcp/handler.ts) → HTTP 401 with JSON-RPC id:null. The MCP SDK transport cannot correlate a non-200/id:null response to the pending request → the request hangs until the client's 30s timeout → server marked unstable.- Same class:
ping, prompts/get, logging/setLevel all 401 anonymously. ping is the worst sibling — SDK keepalive pings hang the same way.
Evidence
- Live: anon
prompts/list → 401 {"id":null,"error":{"code":-32001,...}}; anon ping/prompts/get/logging/setLevel identical.
- E2E repro with [email protected]: id 0/1/3 responded, id=2 NO RESPONSE (hang) — identical to customer log.
- Axiom wm_api_usage last 24h: 548 anon 401s on POST /mcp, UAs include
node (mcp-remote), claude-code/2.1.197 (claude-desktop), Claude-User.
Fix
Add ping, prompts/list, prompts/get, logging/setLevel to PUBLIC_MCP_METHODS. All four are metadata/no-op class: prompts are static workflow templates (no data, no quota), logging/setLevel is a no-op ack, ping is a spec-mandated liveness check. Anonymous traffic on them stays behind applyAnonDiscoveryLimit (60/min/IP). Update docs/mcp-overview.mdx §Discovery + handler comment; add anon wire-contract tests.
Related: #4719 (resources/list made anon), #4698 (public discovery). Sibling issue: OAuth DCR dead on apex (filed separately).
Customer report
Claude Desktop via
[email protected]→https://worldmonitor.app/mcp: initialize + tools/list + resources/list respond ~500ms, butprompts/list(id=2) never gets a response; after the 30s timeout the client sendsnotifications/cancelled, marks the server unstable, and refuses all subsequent tools/call.Root cause (reproduced live + E2E via [email protected])
initializeis public and succeeds anonymously → mcp-remote never receives a 401 challenge at connect → never runs OAuth → session stays anonymous.initializeadvertisesprompts+loggingcapabilities to that anonymous session.prompts/listis NOT inPUBLIC_MCP_METHODS(api/mcp/handler.ts) → HTTP 401 with JSON-RPCid:null. The MCP SDK transport cannot correlate a non-200/id:nullresponse to the pending request → the request hangs until the client's 30s timeout → server marked unstable.ping,prompts/get,logging/setLevelall 401 anonymously.pingis the worst sibling — SDK keepalive pings hang the same way.Evidence
prompts/list→ 401{"id":null,"error":{"code":-32001,...}}; anonping/prompts/get/logging/setLevelidentical.node(mcp-remote),claude-code/2.1.197 (claude-desktop),Claude-User.Fix
Add
ping,prompts/list,prompts/get,logging/setLeveltoPUBLIC_MCP_METHODS. All four are metadata/no-op class: prompts are static workflow templates (no data, no quota), logging/setLevel is a no-op ack, ping is a spec-mandated liveness check. Anonymous traffic on them stays behindapplyAnonDiscoveryLimit(60/min/IP). Update docs/mcp-overview.mdx §Discovery + handler comment; add anon wire-contract tests.Related: #4719 (resources/list made anon), #4698 (public discovery). Sibling issue: OAuth DCR dead on apex (filed separately).