Salesforce Hosted MCP — "MCP server returned 405" after successful OAuth (sandbox, sobject-all)

[trevhud]

MCP server URL or name

https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-all

How are you connecting to this server?

From a custom connector URL I entered manually

Where does the issue occur?

After completing OAuth — token issued by Salesforce, MCP handshake fails.

When did you last reproduce this?

2026-05-01

Browser and OS

Chrome on macOS Darwin 24.6.0 (Sonoma); also reproducible in Claude Desktop on the same machine.

Describe the issue

OAuth handshake completes successfully — Salesforce issues the token and the
External Client App's OAuth Usage page shows the connection. Claude then
fails with "Authorization with the MCP server failed" when attempting the
post-auth MCP handshake.

The error redirect exposes the underlying cause:

?oauth_error_detail=The+MCP+server+returned+a+405+status+code+error.

This is consistent with Anthropic's hosted-MCP broker probing `GET /mcp`,
getting back a spec-compliant HTTP 405, and treating it as fatal. Per the
MCP Streamable HTTP spec, servers MUST respond to `GET` with either
`text/event-stream` or `405 Method Not Allowed` — Salesforce's choice of
405 is spec-compliant.

Critical evidence this is broker-side, not config: the same External
Client App, same Consumer Key, same MCP server URL connects and works
perfectly via Claude Code CLI (native HTTP transport, no pre-flight `GET`
probe). It only fails through the Anthropic broker used by claude.ai web
and Claude Desktop.

Same pattern reported in #171, #184, #198, #246.

Error details

```
Authorization with the MCP server failed. You can check your credentials
and permissions. If this persists, share this reference with support:
ofid_ff0162a6df842c68
```

Additional ofid from a separate retry: `ofid_301cdeb948d766b2`

Redirect URL after the failure:

https://claude.ai/customize/connectors?oauth_error_detail=The+MCP+server+returned+a+405+status+code+error.

Expected behavior

Broker should accept `HTTP 405` on `GET /mcp` as spec-compliant and proceed
to `POST` message exchange — same path Claude Code takes successfully.

Additional context

External Client App configuration matches the canonical Salesforce
doc: https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/create-external-client-app.html

• Scopes: `mcp_api` + `refresh_token`
• PKCE: enabled
• Issue JSON Web Token (JWT)-based access tokens for named users: enabled
• Enable Authorization Code and Credentials Flow: disabled
• Require secret for Web Server Flow: disabled
• Require secret for Refresh Token Flow: disabled
• Callback URLs: `https://claude.ai/api/mcp/auth_callback\`, `http://localhost:8080/callback\`

`sobject-all` MCP server is activated in Setup. Already tried the
deactivate→reactivate workaround from #171 — no change.

Same ECA + Consumer Key works in Claude Code CLI against the same MCP
server URL, both today.

Salesforce-side context: forcedotcom/mcp-hosted#12, where @rossbelmont
noted Salesforce is "working with Anthropic on a Claude-specific issue."

[localden]

Thank you for the detailed report and for including the reference IDs — they let us trace the failure end-to-end.

What's happening: The OAuth flow is completing successfully — Claude obtains a valid access token from Salesforce. The failure is on the next step: when Claude sends the MCP initialize request to the Salesforce Hosted MCP endpoint with that token, Salesforce returns 404 Not Found. Claude then tries an alternative transport probe with a GET request, which Salesforce rejects with 405 Method Not Allowed — that 405 is a follow-on artifact of Claude's probe, not the underlying error. The "Authorization with the MCP server failed" message is also a misleading label for this case: authorization succeeded; the 404 came after.

A 404 on the Hosted MCP endpoint after a successful OAuth typically means the Salesforce identity that authenticated doesn't have access to that MCP server — most commonly because the MCP server isn't activated in the Salesforce API Catalog for that org or sandbox, or the user's permission set doesn't grant it. It can also happen if you re-authenticated into a different sandbox than the one where the MCP server is enabled.

Things to check on the Salesforce side:

1. Confirm the Hosted MCP Server (sobject-all) is activated in the API Catalog for the org or sandbox you're connecting to. See Salesforce's Hosted MCP setup guide.
2. Confirm the connected app and permission sets grant the authenticating user access to the MCP server.
3. If you're using a sandbox, confirm you authenticated into the sandbox where the MCP server is enabled — a re-authentication can land in a different sandbox.
4. Check whether the connection works if you switch from sobject-all to a narrower scope like sobject-reads — that can help isolate whether it's a per-server activation gap.

There's a longer thread on this Salesforce Hosted MCP setup pattern in #171, where several reporters worked through API Catalog activation and connected-app configuration.

If you've confirmed the Salesforce-side config and still hit the error, please retry and share a fresh flow_id from the error URL.