“Authentication failed” is a headline. Capture the failing boundary.

1. Name the n8n MCP surface

Write down the exact endpoint shape and which of these three roles n8n is playing. Do not paste the token into the worksheet.

2. Capture the real response

Record the exact status, response body, authentication challenge, final URL after redirects, timestamp, and request or correlation ID. A client may collapse several different 401 and 403 responses into the same “Authentication failed” label.

Run the credential-free endpoint check first to expose redirects, response types, initialize behavior, and OAuth protected-resource metadata without placing a token in the report.

If OAuth returns invalid_target, use the local resource-identity check to compare the endpoint, requested resource, and advertised protected-resource metadata without uploading the URLs.

3. Match URL and transport before changing auth

• Use the production URL when the MCP Server Trigger workflow is published.
• Use the test URL only while n8n is listening for a test event or executing the unpublished workflow.
• Confirm the client transport matches SSE or Streamable HTTP for the URL you selected.
• Call the canonical final URL directly; record any host or path change in the redirect chain.
• For instance-level MCP, copy the server URL from the Connection details panel rather than reconstructing it.

4. Remove the agent from the test

Use a direct MCP client to connect, initialize, list tools, and make one low-risk tool call. The official MCP Inspector is designed for connection, capability, schema, and tool testing. Keep the credential in the client configuration; never include it in a screenshot, support post, or intake.

5. Verify the credential contract

For an MCP Server Trigger, confirm the node and client use the same documented Bearer or Header authentication contract. For instance-level MCP, distinguish the OAuth2 flow from the personal access-token flow. Compare header name, scheme, and non-secret length or fingerprint—not the raw value.

If the authorized direct client still returns 403, capture a redacted request-header name list at the final server boundary. That separates a header lost or rewritten in transit from a credential rejected after arrival.

6. Check the self-hosted request path

n8n documents that SSE and Streamable HTTP need persistent requests to reach the same server instance. With multiple webhook replicas, route all /mcp* traffic to one dedicated webhook replica. Behind a reverse proxy, preserve the MCP path and disable buffering for that endpoint.

7. Build a support-quality minimum reproduction

Use one new, isolated workflow or one instance-level connection and preserve the first failure. Include the n8n version, Cloud or self-hosted deployment, MCP surface, endpoint shape with identifiers redacted, transport, authentication type, exact status and body, timestamp, request ID, and direct-client result.

State the target outcome in one sentence: “initialize and tools/list succeed, then this one low-risk tool returns the expected result.”

Official references

• n8n MCP Server Trigger documentation ↗
• n8n instance-level MCP connection documentation ↗
• Model Context Protocol Inspector ↗

Agent Rescue Desk is independent and is not affiliated with, endorsed by, or sponsored by n8n or the Model Context Protocol project.