# MCP server not connecting in your AI tool

> Fix the SupaHost MCP server failing to connect in Claude Code, Cursor, VS Code and others: wrong URL, missing Bearer header, 401 invalid token, 403 scope errors and missing tools.

Source: https://supahost.app/kb/mcp-not-connecting · Updated 2026-11-11

## What you see

Your AI tool lists the `supahost` MCP server as failed, disconnected or "needs authentication", or it connects but shows fewer tools than you expected. If you look at the raw response, you'll see one of these:

```json
{"jsonrpc":"2.0","error":{"code":-32001,"message":"Missing or invalid SupaHost access token. Create one in the dashboard: https://supahost.app/dashboard/tokens"},"id":null}
```

```json
{"error":"This token is scoped to project app-one, not app-two."}
```

```json
{"jsonrpc":"2.0","error":{"code":-32000,"message":"Method not allowed"},"id":null}
```

## Why it happens

The SupaHost MCP server is a remote server at `https://mcp.supahost.space/mcp` that speaks Streamable HTTP. Every request must carry your SupaHost access token in a header:

```
Authorization: Bearer shp_<48 hex characters>
```

Common mistakes:

- **No header, or the wrong format.** The token goes after `Bearer ` with a space. Leaving out `Bearer`, or putting the token in the URL, gets a 401.
- **The environment variable isn't set** where the tool runs. A config with `${SUPAHOST_TOKEN}` sends an empty token if your editor was started before you exported it.
- **The token was revoked**, or copied with a missing character. Tokens are shown only once.
- **A Supabase Cloud token.** Tokens starting `sbp_` are for Supabase Cloud; SupaHost tokens start `shp_`.
- **The client tries OAuth.** There's no OAuth sign-in for this server yet. Clients that only support OAuth connectors (Claude.ai and ChatGPT's web connectors) can't connect for now.
- **Scope mismatch (403).** A `?project=` or `?instance=` in the URL that doesn't match the token's scope.
- **Opening the URL in a browser** sends a GET, which returns 405. That's expected; MCP clients use POST.

## How to fix it

1. **Create a fresh token** on *Dashboard → **Access tokens** → **New token***. Pick the scope (one project, or **Whole instance (all projects)**) and whether it's read-only. Copy it straight away.

2. **Export it** in the shell your tool starts from, then restart the tool:

   ```bash
   export SUPAHOST_TOKEN="shp_..."
   ```

3. **Check the config.** For Claude Code:

   ```bash
   claude mcp add --scope project --transport http supahost "https://mcp.supahost.space/mcp" \
     --header "Authorization: Bearer ${SUPAHOST_TOKEN}"
   ```

   For Cursor (`.cursor/mcp.json`):

   ```json
   {
     "mcpServers": {
       "supahost": {
         "url": "https://mcp.supahost.space/mcp",
         "headers": { "Authorization": "Bearer ${env:SUPAHOST_TOKEN}" }
       }
     }
   }
   ```

   *Dashboard → **AI agents (MCP)*** generates the right snippet for 19 clients.

4. **Test the token outside the tool:**

   ```bash
   curl -s -X POST https://mcp.supahost.space/mcp \
     -H "Authorization: Bearer $SUPAHOST_TOKEN" \
     -H "Content-Type: application/json" \
     -H "Accept: application/json, text/event-stream" \
     -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1"}}}'
   ```

   A JSON result naming the server `supahost` means the token and network are fine, so the problem is in the tool's config. A 401 means the token is wrong or revoked.

5. In Claude Code, run `/mcp` to see the server's status after changes.

## Connected, but tools are missing

- **Read-only** tokens, or `read_only=true` in the URL, don't register write tools such as `apply_migration` or `deploy_edge_function`.
- **Project-scoped** tokens don't get `list_projects`, `get_project` or `create_project`.
- **Storage tools** aren't on by default. `features=` in the URL replaces the default list, so name every group you want, for example `?features=docs,account,database,debugging,development,functions,storage`.

## On SupaHost

- Only a hash of each token is stored, so a lost token can't be shown again. Revoke it and create a new one.
- The **Access tokens** page shows each token's prefix, scope and **Last used**, which tells you whether your tool's requests are arriving at all.
- Writes made over MCP appear in *Dashboard → **Activity*** as `MCP (<token name>)`.

## Related

- [The SupaHost MCP server](/docs/ai-tools/mcp)
- [Connect Claude Code](/docs/ai-tools/claude-code)
- [Connect Cursor](/docs/ai-tools/cursor)
- [Access tokens](/docs/platform/access-tokens)