# MCP health report

**URL:** https://mcp.neuroautomata.axonagentic.ai/mcp
**Checked:** 2026-09-21T08:13:04.165Z
**Verdict:** FAIL (score 55/100, issues 1, warnings 2)

## Checks
- ✅ 401だが WWW-Authenticate を返す(仕様どおりの拒否)
- ⚠️ レガシー initialize を HTTP 401 で拒否。ディレクトリのヘルスチェックがここで落ちる(自社の実測で確認)
- ❌ tools/list が HTTP 401 で閉じている。カタログ/ディレクトリが内容を索引できない
- ✅ tools/call は認証で守られている(正しい)
- ⚠️ 401だが resource_metadata を名乗っていない(名乗るサーバーが多数派)

## Raw
| probe | HTTP |
|---|---|
| initialize (MCP-Protocol-Version) | 401 |
| initialize (legacy, no header) | 401 |
| tools/list (no auth) | 401 |
| tools/call (no auth) | 401 |


**WWW-Authenticate:** `Bearer error="invalid_token", error_description="Authentication failed. The provided bearer token is invalid, expired, or no longer recognized by the server. To resolve: clear authentication tokens in your MCP client and reconnect. Your client should automatically re-register and obtain new tokens."`

## How to fix
1. **Open discovery, lock execution.** Answer `initialize` and `tools/list` without credentials; keep `tools/call` behind auth. (Measured: every healthy server in a 110-server sample exposes tools; most unhealthy ones expose none.)
2. **Never reject a legacy handshake.** Directory health checks identify as legacy clients and omit `MCP-Protocol-Version`. Rejecting it is what kept our own server unhealthy for three days.
3. **On 401, always send `WWW-Authenticate: Bearer realm="…"`.** A 401 without it looks broken to crawlers.
4. **Optionally advertise `resource_metadata`** (RFC 9728) in that header and serve the document at that URL.

Generated by https://mcp-health.rowu.workers.dev