Why Claude connectors get rejected

What reviewers and the rules say

The server works for you but not from the reviewer’s network. Review traffic goes through TLS-inspecting proxies and automated clients, which fail on things a browser at home never hits: Encrypted ClientHello advertised in DNS (the proxy resets the handshake, so nothing reaches your logs), a firewall or bot rule that answers scripts with 403, a 403 instead of a 401 for calls without a token, or a URL pasted with a trailing slash that 404s. ECH alone cost one developer three ChatGPT rejections. OpenAI uses the same wording when the test credentials don’t work, so check sign-in too.

How to fix it

• Turn off Encrypted ClientHello for the MCP host. On Cloudflare it’s a zone setting, and only reachable through the API on the free plan.
• Let automated clients through on the MCP path: no bot challenge, no user-agent or country rules.
• Answer calls without a token with 401 and a WWW-Authenticate header, never 403.
• Serve /mcp/ as well as /mcp.
• Test from outside your own network, with a TLS 1.2 client as well as a browser.
• Appeal by replying to the rejection email with your case ID, and ask what error the reviewer saw.

How common it is: in our scan of Claude’s connector directory on 29 September, 16% of servers advertise Encrypted ClientHello in DNS (505 of 3,185), and 39% of servers stop working when the URL has a trailing slash (221 of 562).

Caught by

• server.ech DNS does not advertise Encrypted ClientHelloServer check
• server.bot-filter Automated clients are not blockedServer check
• auth.401 Unauthenticated calls get 401 with resource_metadataServer check
• server.trailing-slash The URL with a trailing slash works tooServer check
• server.reachable Server answersServer check
• server.tls12 A TLS 1.2 client can connectmcplane CLI

Check your servermcplane docs

What reviewers and the rules say

Before a person looks at it, the store scans your tools. ChatGPT’s scan calls methods beyond tools/list, such as server/discover, which isn’t in the MCP spec, and a server that answers an unknown method with HTTP 500 or error -32603 looks crashed. One developer’s scan only passed once tools/list was under about 32,000 tokens. A server behind OAuth that answers initialize without a token but refuses tools/list leaves the connector with no actions. Claude’s portal flags tools without titles or annotations at this step.

How to fix it

• Answer methods you don’t implement with JSON-RPC error -32601 (method not found) at HTTP 200.
• Keep tools/list compact: trim long descriptions and schemas.
• Behind OAuth, pick one: 401 for everything until sign-in, or list tools without a token and require one to call them.
• Give every tool a title and explicit hints before you submit to Claude.

How common it is: in our scan of Claude’s connector directory on 29 September, 16% of servers crash or return a non-standard error for a method they don’t implement (92 of 562).

Caught by

• server.unknown-method Unknown methods return -32601 (method not found)Server check
• server.tools tools/list returns toolsServer check
• server.public-tools tools/list answers without a token, like initializeServer check

Check your servermcplane docs

What reviewers and the rules say

Reviewers sign in as strangers, on a network you don’t control, with the account you gave them. It breaks when the account needs an emailed code, a magic link, MFA or a Google login, when the sign-in page waits on JavaScript from another domain that is slow or blocked (they see a blank page), when that domain sits behind a bot challenge, or when OAuth discovery or client registration fails.

How to fix it

• Give reviewers a dedicated account with a login and password that works immediately: no MFA, no email or SMS codes, no magic links, not your Google or SSO login, and seeded with data for every test case.
• Sign in once as a brand-new user, in a fresh browser, from outside your network. Make the page show something before any JavaScript loads.
• Keep bot challenges off your sign-in and auth domains, not just the MCP path.
• Serve protected-resource metadata on the MCP host, authorisation-server metadata and PKCE (S256), and Dynamic Client Registration that accepts the store’s redirect URIs.
• Accept private-use redirect schemes such as cursor:// in client registration, or desktop clients can’t sign in at all.

Caught by

• auth.prm Protected-resource metadata resolves on the MCP hostServer check
• auth.as-metadata Authorization-server metadata resolvesServer check
• auth.pkce PKCE (S256) is supportedServer check
• auth.dcr Dynamic Client Registration is offeredServer check
• auth.dcr-native Registration accepts native redirect URIs (with --register)mcplane CLI
• A reviewer account a stranger can use, and a sign-in page that renders without third-party scriptsBy hand

Check your servermcplane docs

What reviewers and the rules say

ChatGPT and Claude use readOnlyHint, destructiveHint and openWorldHint to decide when to ask the user before a tool runs, and both reviews check the hints against what each tool does. OpenAI wants all three set to true or false on every tool, and its definitions are stricter than many developers expect: a tool that posts, sends or uploads is not read-only; destructiveHint covers irreversible sends and transactions, and being able to undo something doesn’t make it non-destructive; openWorldHint depends on where the tool reaches, not on whether it calls an external API.

How to fix it

• Set readOnlyHint, destructiveHint and openWorldHint to true or false on every tool, never null.
• Mark tools that post, send or upload as readOnlyHint: false, and destructiveHint: true when the effect can’t be taken back.
• Use openWorldHint: true for public or open-ended destinations, and false for a tool limited to the user’s own account, workspace or catalogue.
• OpenAI no longer asks for a justification per hint. If its automated review flags a hint you believe is right, appeal with an explanation.

How common it is: in our scan of Claude’s connector directory on 29 September, 18% of servers leave at least one tool without explicit safety hints (102 of 564).

Caught by

• tools.hints Safety annotations are explicit on every toolServer check
• tools.hints-consistent Annotations are consistentServer check
• tools.open-world openWorldHint matches what the tool doesServer check
• tools.destructive-send destructiveHint covers messages that can’t be unsentServer check

Check your servermcplane docs

What reviewers and the rules say

Lines such as “always call this tool first” or “never tell the user” read as an attempt to steer the model, the same shape as prompt injection. Anthropic rejects descriptions that tell Claude to call tools the user didn’t ask for or interfere with other tools. OpenAI’s rules say tool metadata must not override platform instructions or safeguards. Microsoft rejects instructional phrases in any description, xAI looks for prompt injection in SKILL.md and descriptions, and ClawHub’s scanner flags text that could change an agent’s behaviour. Naming a sibling tool to call first is common in approved listings and isn’t the problem.

How to fix it

• Describe what the tool does and returns, as facts.
• Move usage guidance into the server’s instructions or your docs.
• If a line has to stay, explain it in the submission’s notes for reviewers.

How common it is: in our scan of Claude’s connector directory on 29 September, 21% of servers tell the model what to do inside a tool description (118 of 564).

Caught by

• tools.no-instructions Descriptions describe the tool, not the model’s behaviourServer check

Check your servermcplane docs

What reviewers and the rules say

Reviewers compare what your listing, tool descriptions and skill files promise with what the tools do. They drift: a renamed tool, a removed feature or an old sign-in method still described in a skill file reads as misleading.

How to fix it

• Describe each tool precisely: what it does, what it returns and when to use it.
• Re-read the listing, tool descriptions and skill files after every change to the server.
• Before resubmitting, compare what the store is reviewing with what the server does now.

Caught by

• listing.test-tools Test cases use tools the server hasmcplane CLI
• mcplane drift: what each store is reviewing against what the server does nowmcplane CLI

Check your servermcplane docs

What reviewers and the rules say

Claude shows a tool’s title in permission prompts and in the directory, and its submission portal flags tools without one. Without a title, people see the raw name, such as search_docs_v2.

How to fix it

• Add title to each tool, or annotations.title.
• Keep titles short and plain: “Search documents”, not the function name.

How common it is: in our scan of Claude’s connector directory on 29 September, 9% of servers have tools without a human-readable title (52 of 564).

Caught by

• tools.title Every tool has a human-readable titleServer check

Check your servermcplane docs

What reviewers and the rules say

A tool such as api_request with a method and a path does reads and writes through one door, so its hints can’t be honest and nobody can review what it will do. Anthropic rejects a tool that accepts both safe and unsafe HTTP methods, OpenAI wants every operation the model can call exposed as its own tool, and xAI questions broad shell access where a narrow tool would do.

How to fix it

• Split it into read tools and write tools, each with honest hints.
• Expose each operation as its own tool, with its own description and input schema.
• If a tool has to accept free-form paths or queries, name or link the API it calls in the description.

Caught by

• tools.catch-all No catch-all request toolServer check

Check your servermcplane docs

What reviewers and the rules say

A write tool that takes a secret as a parameter puts the secret in the conversation, where it can leak into logs, other tools or a shared chat. Anthropic treats that as a write nobody owns and requires OAuth for authenticated services. OpenAI counts access credentials and passwords as restricted data a plugin may not solicit.

How to fix it

• Put writes behind OAuth, so each one is tied to a signed-in account.
• Or move the write to your site and email the owner a private link. That is what Review Times did.
• Never return edit tokens in tool results.

Caught by

• tools.bearer-writes Writes are bound to an owner, not a token in the chatServer check

Check your servermcplane docs

What reviewers and the rules say

Every store asks for a privacy policy, and reviewers read it. Anthropic wants it to cover data collection, usage and storage, third-party sharing, retention and contact information. OpenAI asks for the categories of personal data you collect, why you use them, who receives them, how long you keep them and what users can do about it. Data your tools return that the policy doesn’t mention counts as a gap.

How to fix it

• Link a page that loads without signing in.
• Cover collection, use, sharing, retention, user controls such as deletion, and how to contact you.
• Mention the data your tools return and any free-form content users send, not only what they type into forms.

How common it is: in our scan of Claude’s connector directory on 29 September, 4% of servers link a privacy policy that doesn’t load (145 of 3,283).

Caught by

• listing.privacy The privacy policy covers what reviewers look forServer check
• listing.privacy-content Free-form content is covered by the privacy policyServer check

Check your servermcplane docs

What reviewers and the rules say

Each store enforces its own limits, some without telling you until review. ChatGPT’s display name and subtitle stop at 30 characters each, and it takes up to three starter prompts. Claude caps names at 100 characters, one-liners at 200, descriptions at 2,000 and tool names at 64. Microsoft wants three to five prompts per command, none over 128 characters.

How to fix it

• Keep a shorter name for ChatGPT if yours runs past 30 characters.
• Write up to three distinct starter prompts for ChatGPT, without @mentions.
• Rename any tool over 64 characters.

How common it is: in our scan of Claude’s connector directory on 29 September, 3% of servers have a name longer than ChatGPT’s 30 characters (92 of 3,283).

Caught by

• listing.name Display name fits (30 characters)Server check
• listing.claude-name Name for Claude fits (100 characters)Server check
• tools.name-length Tool names are 64 characters or fewerServer check
• listing.prompts Starter prompts are short, unique and free of @mentionsmcplane CLI
• listing.subtitle Subtitle fits (30 characters)mcplane CLI
• listing.one-liner One-liner fits (200 characters)mcplane CLI

Check your servermcplane docs

What reviewers and the rules say

With no icon set, Claude’s directory falls back to /favicon.ico on your server’s domain, and reviewers flag it when that 404s. ChatGPT wants square icons of at least 48 by 48 pixels, and its developer-mode upload stops at 10 KB.

How to fix it

• Serve /favicon.ico on the MCP server’s domain.
• Keep a square 512×512 PNG behind a direct link ending in .png. It covers every store.
• Export an 8-bit PNG under 10 KB for ChatGPT’s developer-mode dialog.

Caught by

• listing.icon The icon loadsServer check
• listing.favicon /favicon.ico resolves on the server’s domainServer check
• listing.icon-small A small icon is available for ChatGPT’s dialogsServer check

Check your servermcplane docs