A reverse proxy buffering SSE breaks remote MCP after OAuth and initialize succeed

Fast answer

Queries this answers

• Claude Desktop custom MCP connection failure; confirmed root cause is Cloudflare Tunnel buffering SSE despite successful OAuth/initialize
• Claude Desktop custom MCP connection failure; confirmed root cause is Cloudflare Tunnel buffering SSE despite successful OAuth/initialize fix
• Claude Desktop custom MCP connection failure; confirmed root cause is Cloudflare Tunnel buffering SSE despite successful OAuth/initialize root cause
• A reverse proxy buffering SSE breaks remote MCP after OAuth and initialize succeed
• A reverse proxy buffering SSE breaks remote MCP after OAuth and initialize succeed fix
• A reverse proxy buffering SSE breaks remote MCP after OAuth and initialize succeed root cause
• how to fix A reverse proxy buffering SSE breaks remote MCP after OAuth and initialize succeed
• claude-desktop breaks remote mcp after oauth initialize succeed

Record metadata

Common search queries

• mcp-reverse-proxy-buffers-sse-connection-fails
• mcp reverse proxy buffers sse connection fails
• A reverse proxy buffering SSE breaks remote MCP after OAuth and initialize succeed
• A reverse proxy buffering SSE breaks remote MCP after OAuth and initialize succeed fix
• A reverse proxy buffering SSE breaks remote MCP after OAuth and initialize succeed root cause
• streamable-http
• reverse-proxy
• cloudflare-tunnel
• buffering
• remote-mcp
• claude-desktop
• mcp-server

Symptoms

• the client connects to a custom remote MCP then errors (e.g. 'There was an error connecting to your server')
• server logs show success through registration, OAuth authorize, token exchange, initialize, and the SSE GET with Accept: text/event-stream, then nothing flows
• direct non-proxied access works; only the proxied/tunnelled path fails

Environment

Root cause

• MCP Streamable HTTP streams responses over SSE, which must be flushed incrementally.
• A proxy/tunnel that buffers responses (Cloudflare Tunnel buffers SSE; Nginx with proxy_buffering on) holds bytes until the response completes, which never happens for a long-lived stream.
• So the client times out or errors despite a healthy OAuth/initialize handshake.

Fix

1. Disable response buffering for the MCP endpoint at the proxy.

   proxy_buffering off;

   For Nginx set proxy_buffering off (and disable gzip) on the MCP location; other proxies have an equivalent.

2. If the tunnel buffers SSE and cannot be configured (e.g. Cloudflare Tunnel), route the MCP endpoint to bypass the buffering layer or use a streaming proxy.

3. Confirm the proxy forwards text/event-stream responses unbuffered and does not strip streaming headers.

Verification

• Connect through the proxy and watch the stream.

  Expected: The SSE stream flows after initialize and the client finishes connecting and lists tools.

Workarounds

• Expose the MCP endpoint directly (non-proxied) for testing to confirm buffering is the cause.

Anti-patterns

• Debugging OAuth when OAuth already succeeded and the SSE stream is what is buffered.
• Leaving default proxy_buffering on for an MCP streaming endpoint.

Sources

• anthropics/claude-code issue 5826: Claude Desktop custom MCP connection failure; confirmed root cause is Cloudflare Tunnel buffering SSE despite successful OAuth/initialize (issue)

No matching fix?

If this record is close but does not solve the user's failure, create a safe unresolved-pit report instead of guessing. Include exact symptoms, environment, attempted fixes, and the record ids already checked.

Ask for help with an unresolved pit|Agent protocol