Why - the stored token was issued by a different Copyleaks authorization server than the one this endpoint trusts.Fix - remove the stored credential and sign in again. If your Copyleaks account is not served from extensions.copyleaks.com, contact Copyleaks support for the address that serves it.
Why - Claude Code reads a typeless entry as a local command and skips it.Fix - add "type": "http". "streamable-http" is accepted as an alias.
Why - the stored token expired and was issued without offline_access, so there is no refresh token.Fix - add offline_access, then sign in again. If it recurs within the hour, check the machine clock - skew of more than a few minutes invalidates the token’s signature window.
Why - sign-in succeeded on a narrower permission set than the tools require.Fix - remove any scopes / includeTools / enabled_tools narrowing, sign in again, then reintroduce limits once you know which tools you need. On Gemini CLI and Antigravity, also check how many connectors you have enabled - they cap the total tools loaded across all servers, and Copyleaks adds twelve.
Why - the config landed in the wrong file or scope.Fix - let the client write the file: claude mcp add, gemini mcp add, codex mcp add, or the editor’s Add Server command. Read it back with claude mcp get or /mcp.
Why - no active paid plan.Fix - reactivate in your Copyleaks account. Access ends with the plan.
Why - no credits left.Fix - add credits. Reading existing results is unaffected.
Why - your network inspects TLS and re-signs with a certificate authority your client’s trust store does not know.Fix - point the client at your organization’s root certificate. Node-based clients (Claude Code, Gemini CLI, Antigravity, mcp-remote) read NODE_EXTRA_CA_CERTS; Python-based ones read REQUESTS_CA_BUNDLE or SSL_CERT_FILE.
Why - the client tried to register itself with the authorization server and was refused.Fix - confirm the client is on a current version, and that nothing on your network blocks the sign-in redirect. If it persists, contact Copyleaks support with the client name and version.
Why - the local redirect failed.Fix - paste the full callback URL from the browser’s address bar back at the prompt.
Why - scope.Fix - re-add with --scope user.
Why - the scan did not complete.Fix - run it again. A failed scan spends nothing.
Why - no usable browser on this machine.Fix - open the printed URL yourself, or sign in with --no-browser and paste the redirect URL back at the prompt.
Client schemas move quickly - when a config block stops working, check the vendor’s documentation before changing the server.