MCP behind Cloudflare Access OAuth logs in but exposes no tools

[joshmeadixo]

I’m self-hosting OpenSEO and trying to connect the MCP endpoint through Cloudflare Access with Managed OAuth enabled.

Setup tested:

• Docker OpenSEO behind Cloudflare Tunnel + Access
• Cloudflare Worker OpenSEO deployment + Access
• Managed OAuth enabled
• Dynamic client registration enabled

In both Codex and Claude, OAuth login starts successfully, but MCP tools are not exposed.

Codex shows:

Auth required, when send initialize request resource_metadata="https://.../.well-known/cloudflare-access-protected-resource/mcp"

Claude reports:

Couldn't register with OpenSEO's sign-in service... add an OAuth Client ID

Is there any extra OAuth client/config step required beyond enabling Cloudflare Access Managed OAuth?

[bensenescu]

Hey thanks for opening this @joshmeadixo , investigating this now.

[bensenescu]

Hey @joshmeadixo, I just updated the docs, I think it could be this loopback issue.

#48

In Managed OAuth settings, allow the redirect URIs your MCP clients use:

• Allow localhost / loopback clients — for CLI and desktop agents (Codex
  CLI, Claude Code) that register http://localhost:PORT/callback.
• Add HTTPS redirect URIs for web connectors (a path may end in /*).
• Without this, clients can't finish Dynamic Client Registration
  and log in but expose no tools.

https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/managed-oauth/