Testing and troubleshooting - MCP

2 min read Updated: 11.09.2026

On this page Testing the integration
  1. Testing the integration
  2. Common problems
  3. A tool is missing from tools/list
  4. issues.get does not exist for this key
  5. The key stopped working overnight
  6. The request ends in 403
  7. The key does not work despite a valid token and permissions
  8. Still not working

Testing the integration

Call tools/list from an MCP client and compare the result with the permissions ticked when the key was created - the list should contain exactly those tools, not more. Then call one read tool, for instance projects.list, and check in Settings → MCP Integration that the key's last-used date has updated.

Common problems

A tool is missing from tools/list

A tool appears in the response only when the key holds the permission tied to it. Check the key's settings for that permission - a tool without it is not hidden or blocked, it simply does not exist from that key's point of view.

issues.get does not exist for this key

The issues.read permission alone only grants group metadata through issues.list - the error message, the failing location, the stack trace and the full request data need the separate issues.details permission, unticked by default. Enable it deliberately in the key's settings once a tool genuinely needs to diagnose errors.

The key stopped working overnight

A key's scope is intersected with the current permissions of the person who issued it, on every request. If that person was demoted, lost a specific permission, or their account was deactivated, the key narrows or stops working immediately - with no change to the key itself. Restoring the issuer's permissions restores the key's full scope, because the row in the database stays untouched the whole time.

The request ends in 403

Check the request's Origin header. The MCP server rejects any request whose header points to a foreign domain - that is a safeguard against browser calls, not a configuration mistake. This endpoint is meant for server-side clients, not code running in a user's browser.

The key does not work despite a valid token and permissions

Check whether the account still has the MCP component purchased - it is a paid plan feature, and losing it (for instance after dropping to the free plan) turns off authentication for every key on the account, regardless of what permissions they were issued with.

Still not working

Work through the troubleshooting checklist, and if that does not help, write to us. Include the project name, the integration version and roughly when you ran the test: it shortens the way to an answer.

Keep reading

DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Free to subscribe. Unsubscribe with one click in any email.