# Troubleshooting

> Symptoms, causes and fixes for a connection that will not behave.

### Check the endpoint first

Before blaming a client, check the endpoint from the same machine. This request is unauthenticated on purpose:

```bash
curl -sS -D - -o /dev/null \
  -X POST https://extensions.copyleaks.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize",
       "params":{"protocolVersion":"2025-06-18","capabilities":{},
       "clientInfo":{"name":"probe","version":"1"}}}'
```

A healthy server answers:

```
HTTP/2 401
www-authenticate: Bearer resource_metadata=
  "https://extensions.copyleaks.com/.well-known/oauth-protected-resource/mcp"
```

**That 401 is the success case.** It proves the endpoint is reachable, terminating TLS correctly, and advertising its authorization server. A timeout, a 50x, or an HTML error page means the problem is your network, not your config.

Follow the chain one step further to see the permissions on offer:

```bash
curl -sS https://extensions.copyleaks.com/.well-known/oauth-protected-resource/mcp | jq .
```

Once connected, ask your agent to check your Copyleaks credit balance. If it answers, you are done.

### Symptoms and fixes

| Symptom | Why | Fix |
|---|---|---|
| **Added the connector, but no Copyleaks tools appear** | Clients read their server list when a session starts | Start a new session. On Claude Desktop, quit the app completely and reopen it - closing the window isn't enough. Still missing? You haven't signed in: `claude mcp login copyleaks_app`, or `/mcp` in a session |
| **Sign-in succeeds, but every call is unauthorized** | The stored token was issued by a different Copyleaks authorization server than the one this endpoint trusts | Remove the stored credential and sign in again. If your Copyleaks account is not served from `extensions.copyleaks.com`, contact Copyleaks support for the address that serves it |
| **`MCP server "…" has a "url" but no "type"`** | Claude Code reads a typeless entry as a local command and skips it | Add `"type": "http"`. `"streamable-http"` is accepted as an alias |
| **Needs authentication, repeatedly** | The stored token expired and was issued without `offline_access`, so there is no refresh token | Add `offline_access`, then sign in again. If it recurs within the hour, check the machine clock |
| **"Your connection expired"** | The connection to your Copyleaks account has expired | Reconnect Copyleaks in your agent's settings |
| **Connects, but exposes no tools** | Sign-in succeeded on a narrower permission set than the tools require | Remove any `scopes` / `includeTools` / `enabled_tools` narrowing, sign in again, then reintroduce limits once you know which tools you need. **On Gemini CLI and Antigravity, also check how many connectors you have enabled** - they cap the total tools loaded across all servers, and Copyleaks adds twelve |
| **The server is not listed at all** | The config landed in the wrong file or scope | Let the client write the file - `claude mcp add`, `gemini mcp add`, `codex mcp add`, or the editor's Add Server command. Read it back with `claude mcp get` or `/mcp` |
| **Added on claude.ai, but Claude Desktop doesn't have it** | The app didn't fully quit, or it's signed in to a different Claude account | Quit Claude Desktop completely and reopen it, and check it's the same Claude account. The **Code tab** is Claude Code - a connector from **Customize → Connectors** doesn't appear there; add it with `claude mcp add` |
| **Tools appear, but every call is refused** | No active paid plan | Reactivate in your Copyleaks account. Access ends with the plan |
| **Scans are refused but reading works** | No credits left | Add credits. Reading existing results is unaffected |
| **Works in the Chat tab, but "can't scan this file"** | The Chat tab has no upload step, so it can't send larger files | Switch to the **Code tab** of the same app, or upload the file in Copyleaks and ask your agent to read the scan |
| **`unable to verify the first certificate` · `SELF_SIGNED_CERT_IN_CHAIN`** | Your network inspects TLS and re-signs with a certificate authority your client's trust store does not know | Point the client at your organization's root certificate. Node-based clients (Claude Code, Gemini CLI, Antigravity, `mcp-remote`) read `NODE_EXTRA_CA_CERTS`; Python-based ones read `REQUESTS_CA_BUNDLE` or `SSL_CERT_FILE` |
| **`Client registration failed` · `invalid_client`** | The client tried to register itself with the authorization server and was refused | Confirm the client is on a current version, and that nothing on your network blocks the sign-in redirect. If it persists, contact Copyleaks support with the client name and version |
| **Connection error after signing in (CLI)** | The local redirect failed | Paste the full callback URL from the browser's address bar back at the prompt |
| **Works in one project, not another** | Scope | Re-add with `--scope user` |
| **A scan comes back `failed`** | The scan did not complete | Run it again. A failed scan spends nothing |
| **The browser never opened** | No usable browser on this machine | Open the printed URL yourself, or sign in with `--no-browser` and paste the redirect URL back at the prompt |