AgentArmorHQ
Sign in
Monitoring and response

Confirm your MCP server and client versions before debugging login failures

AgentArmorHQ team2 min read

You will confirm your server and client builds include the auth fix before you change login config. This keeps you from debugging a gap that is already closed.

  1. Check versionsRecord server and client builds
  2. Match featureConfirm the release includes the auth fix
  3. Set configApply env vars on the server process
  4. Test one requestRead the status code and headers

Why it matters

A 403 from an n8n instance behind Cloudflare Access looked like a proxy problem, but n8n-mcp only sent the X-N8N-API-KEY header, so requests were rejected (issue #148 (opens external site)). That gap was fixed in v2.64.0, so an older build keeps failing no matter how you edit the config.

Steps

  1. Record the exact server build and client build you run. For n8n-mcp, confirm you are on v2.64.0 or later (issue #148 (opens external site)).
  2. If you use Cloudflare Access with n8n-mcp, set both variables on the n8n-mcp server process:
bash
N8N_CF_CLIENT_ID=your-cf-client-id
N8N_CF_CLIENT_SECRET=your-cf-client-secret
  1. Confirm the service token belongs to the same origin as N8N_API_URL, since the headers are only sent to that origin (issue #148 (opens external site)).
  2. For Azure MCP in Container Apps, record the image tag you deployed instead of relying on latest. Then check that AzureAd__Instance, AzureAd__TenantId and AzureAd__ClientId are set in the container. The IDW10106 ClientId crash appears when one of the AzureAd__ variables is missing (issue #1382 (opens external site)).
  3. For googleapis/mcp-toolbox, confirm your build includes OAuth2 discovery. The feature landed through PR #2698, and the issue was closed as completed (issue #1280 (opens external site)).
  4. Send one unauthenticated request and read the status code and headers. The mcp-toolbox design returns HTTP 401 with a WWW-Authenticate header that points clients at the resource metadata, rather than a 200 with an embedded MCP error (issue #1280 (opens external site)).

Common mistakes

  • Changing client config before confirming the server build. An older server may ignore settings that a newer one honors.
  • Assuming a latest tag is the build that runs. Pin the image version and record it.
  • Leaving AZURE_MCP_DANGEROUSLY_DISABLE_HTTPS_REDIRECTION=true set. It disables HTTPS redirection, so enable it only when you test over HTTP (issue #1382 (opens external site)).
  • Treating a closed issue as a current recipe. Check the linked PR or template for the current fields.

Checklist

0 of 8 done

Sources

  1. n8n-mcp behind Cloudflare Access: how to pass CF-Access-Client-Id/Secret headers?
  2. Azure MCP in Container Apps crashes with IDW10106 'ClientId' error
  3. How to configure OAuth2 discovery in googleapis/mcp-toolbox?
Was this guide useful?