Skip to content

Maintenance & Known Limitations

Known limitations

  • claude.ai web connector does not work. After Cloudflare Access OAuth completes, claude.ai's web connector fails to send the follow-up authenticated MCP request (generic Authorization with the MCP server failed … ofid_… error). This is a client-side Anthropic bug, not a server/Cloudflare problem — confirmed in anthropics/claude-ai-mcp issues #327 and #291 (both closed "not planned"). It affects the OAuth/streamable-HTTP web path. → Use Claude Code or Claude Desktop, which support header auth (service token) and work reliably. If Anthropic fixes the web connector, re-enable Managed OAuth + add a browser identity policy to light up the web app.

  • list_risky_users requires Entra ID P2. Returns 403 not licensed without it. The permission is granted, so it works automatically once P2 is present. (list_risk_detections works regardless.)

Maintenance tasks

  • Rebuild after code/Dockerfile changes: cd /opt/stacks/365-mcp && docker compose up -d --build
  • Rotate the Graph client secret: az ad app credential reset …, update AZURE_CLIENT_SECRET in .env, recreate the container.
  • Rotate the Cloudflare service token: regenerate in Zero Trust → Access → Service Auth, update the headers in each client config.
  • Add a Graph permission: add it in Entra, admin-consent, then add the matching tool/endpoint in server/main.py and rebuild.
  • Keep ~/Templates/365-mcp-stack/ in sync with /opt/stacks/365-mcp/ (it is the source of truth; .env is excluded).