Found during the new-developer first-run journey audit, #10264.
README.md:164-174 heads a section "Your app is AI-operable, for free", states the MCP server is on by default, and offers a copy-paste line:
claude mcp add --transport http my-app http://localhost:3000/api/v1/mcp
Measured against a freshly scaffolded, freshly booted project:
- Unauthenticated
initialize → 401 {"code":"UNAUTHENTICATED","message":"Unauthorized: a valid OAuth access token or API key is required"} - The same call with a session cookie →
200, valid tool list, working.
So the premise holds — MCP really is served at /api/v1/mcp and really is on by default. What fails is the documented command: it carries no auth step and no pointer to how a newcomer obtains a token. The detail lives behind a link to a docs page rather than in the snippet the reader is invited to paste.
This is a headline product claim with a broken copy-paste under it. The feature works; the documentation of it does not, which makes it cheap to fix and disproportionately costly to leave.
Suggested landing (hint for triage, not a routing decision)
README.md:164-174, and worth checking whether the linked docs page states the auth step clearly enough to carry the weight the README is delegating to it.
Filed by the PM loop from the audit in #10264. Not yet graded or routed.
Found during the new-developer first-run journey audit, #10264.
README.md:164-174heads a section "Your app is AI-operable, for free", states the MCP server is on by default, and offers a copy-paste line:Measured against a freshly scaffolded, freshly booted project:
initialize→401 {"code":"UNAUTHENTICATED","message":"Unauthorized: a valid OAuth access token or API key is required"}200, valid tool list, working.So the premise holds — MCP really is served at
/api/v1/mcpand really is on by default. What fails is the documented command: it carries no auth step and no pointer to how a newcomer obtains a token. The detail lives behind a link to a docs page rather than in the snippet the reader is invited to paste.This is a headline product claim with a broken copy-paste under it. The feature works; the documentation of it does not, which makes it cheap to fix and disproportionately costly to leave.
Suggested landing (hint for triage, not a routing decision)
README.md:164-174, and worth checking whether the linked docs page states the auth step clearly enough to carry the weight the README is delegating to it.Filed by the PM loop from the audit in #10264. Not yet graded or routed.