A connection failure can come from the assistant, the network, authentication or the hub’s own restrictions. Check the actual response and module state before changing permissions or issuing another token.

Start with the saved connection

Open PD Modules → MCP Hub → Connect and confirm the assistant uses the endpoint shown for this installation. Use the token in the supported client credential field or authentication header, never as part of the URL.

In Connections, identify the intended row and check whether it is active, expired or revoked. Confirm that its bound staff account is still active. A larger ceiling cannot repair an invalid credential or a disabled endpoint.

Interpret hub responses

1. 401: check the saved token, expiry, revoked state and bound staff account. A missing or stripped credential header can also cause an authentication refusal.
2. 403: read the reason. The source-address restriction or a browser-origin restriction can apply; a proxy can also return its own 403 before the hub handles anything.
3. 503: check Settings → Serve the MCP endpoint and Kill switch. Do not turn off a deliberate stop without understanding why it was set.
4. 429: pause repeated calls and review the connection’s recent activity rather than creating another connection to evade the limit.

An HTML challenge or login page is not a successful MCP response even if the browser can display it. Ask the network administrator to inspect the specific endpoint request and response; broad firewall bypasses are not a diagnosis.

Use the trail as evidence

Review Audit trail with Everything selected and compare the attempt time. A connection entry shows that an assistant initialised a session; a refusal can identify a particular credential or address problem.

No matching row is not conclusive proof of a firewall block. A disabled endpoint can return before logging, the view is recent and filtered, and retention or a logging failure can leave gaps. Check module state and response details alongside network evidence.

If the connection succeeds but a tool is missing, review the catalogue, connection area, ceiling, staff permissions and client scope. Refresh the client’s tool list after an authorised change. For an unresolved problem, provide the connection name, attempt time and redacted status or error without sending the token.

Compare the connection and response

Your hosting team should compare the exact endpoint and response with the saved connection’s active state, expiry, bound staff account, source restriction and the module’s endpoint/kill-switch settings. Distinguish a proxy’s HTML challenge from a hub response. Ask the administrator responsible for your network to inspect that specific request rather than disabling protection broadly. Compare Audit trail with the original time, allowing for filtering and requests rejected before logging.

See the PD MCP Hub Blesta guide for related tasks, or explore PD MCP Hub.