Wrap OAuth around all of MCP and the directories report zero tools

The allowlist that repairs this is four method names long: initialize, notifications/initialized, ping, and tools/list ^[12]. Nothing on that list spends money, which is the test the author of the dev.to writeup applies. Describing what a server offers is not privileged, and calling those tools is ^[12]. The original wrapper was not sloppy, either. Every tool call in that server spends credits, so every tool call needs an identified user ^[7], and the docs and examples encourage wrapping the handler ^[6]. The wrapper simply also caught the one method that costs nothing to answer.

The conditions around the allowlist are the part worth reading twice, because each is a failure someone else will rediscover in production. A request carrying an Authorization header goes down the authenticated path even when its method is public; skip that and a client holding an expired token gets quiet anonymous service instead of the 401 that triggers a refresh ^[13]. The gate applies only to POST, because in Streamable HTTP a GET opens the SSE stream and a DELETE ends the session, and neither carries a JSON-RPC method you can inspect ^[14]. And since JSON-RPC permits batching, the check has to hold for every message in the array rather than any of them, or a tools/call rides in beside a tools/list ^[15].

That last condition has a runtime price: the classifier clones and parses the body of every POST before it knows whether auth applies ^[19]. Behind it sits a second stop. The public path runs with no caller in context, so a tools/call that slipped through finds no user and the charging function refuses ^[16]. The author also names the mistake that would cost more than an empty listing: a hand-rolled 401 that stops advertising WWW-Authenticate, which strips compliant clients of the header they rely on for OAuth discovery ^[17].

Three separate directories published the same empty array for the same server ^[1], which says the emptiness is not one crawler's bug but the predictable output of an anonymous handshake meeting a blanket 401 ^[8]. A crawler cannot distinguish "requires auth" from "does nothing" ^[8], and neither can your logs, where its 401 looks like any other unauthenticated request ^[18]. Middleware that wraps an exported handler operates at the granularity of the transport, not the method, and MCP's first useful move is anonymous by construction ^[4]. Auth strength was never in question here. Placement was, and placement is the thing no test suite was watching.