Troubleshooting
What each error means when you onboard, test, connect or activate a server, and how to fix it.
Onboarding and testing
| Message | What it means | Fix |
|---|---|---|
| Only https:// URLs are allowed | The URL is http://. | Serve the server over https. See Expose a self-hosted server. |
| Private network addresses are blocked… | The hostname resolves to a private, loopback or link-local address. | Expose it publicly with a key, or self-host sremcp with MCP_ALLOW_PRIVATE_NETWORKS=true. |
| Host could not be resolved | DNS has no record for the hostname. | Check the URL. Internal DNS names only resolve for a self-hosted sremcp. |
| Credentials in URLs are not allowed; use the auth settings | The URL contains user:password@. | Remove them and use Authentication. |
| This host is blocked / This address range is blocked | The host is a cloud metadata service or another address sremcp never calls. | Use another host. |
| Host is not in MCP_ALLOWED_HOSTS | Your self-hosted sremcp only calls listed hosts. | Add the host's suffix to MCP_ALLOWED_HOSTS. |
401 / Unauthorized | The server refused the credentials. | Check Authentication, then Rotate secret. Bearer secrets go without the word Bearer. |
403 from Grafana or Kubernetes | Their HTTP mode rejects unexpected Host headers. | Grafana: --allowed-hosts <your hostname>. Kubernetes behind a proxy: disable_localhost_protection = true. See their guides. |
404 | Wrong path. | Most servers answer at /mcp, SSE servers at /sse. |
| A server with this slug already exists | Slugs are unique per organization. | Pick another slug, for example with the environment: grafana-staging. |
Activating
| Message | Fix |
|---|---|
| Run a successful connection test first | Test connection until it succeeds. |
| Approve at least one tool before activating | Approve tools, Save approvals, then Activate. |
OAuth
| Message | Fix |
|---|---|
| Not connected: an SRE or admin needs to click Connect on this server. | Click Connect. |
| This sign-in has expired or was already used. Click Connect again. | Sign-ins expire after 10 minutes. Start again. |
| Only the person who clicked Connect can finish this sign-in. | The consent page was opened by another sremcp user. The person who clicked Connect finishes it. |
| The sign-in for this server expired or was revoked… | The provider refused a refresh. Click Connect (or Reconnect) again. |
| …register sremcp as an OAuth app with them… | The provider supports neither client ID documents nor registration. See Registering sremcp. |
| The client_id and/or client_secret passed are incorrect (GitHub) | Add the app's client secret with Rotate client secret. See GitHub. |
| The Client ID Metadata Document could not be resolved (Clerk, on its page) | Pre-register sremcp, or Refresh metadata on it, in Clerk. See Servers behind Clerk. |
In Investigate
| What you see | Fix |
|---|---|
| 0 approved tools in the header | No active server with approved tools is granted to your role. Ask an SRE or admin. |
| Tool limit reached: only the first 64 tools were loaded | Revoke tools you don't need, or split servers by toolset. |
| This conversation is too long. Start a new one. | Click New investigation. |
| A tool call fails | Open it to see the server's error. The rest of the answer still uses the other tools. |