ChatGPT Says “Couldn't Connect” to Your MCP Server? Check Your .well-known Route

The symptom

You've built an MCP server. It works when you test it directly. Then you add it as a connector in ChatGPT and get a vague error that it couldn't connect. Your app's logs show nothing, because the request never reached your app.

That last detail is the clue. If your application never sees the request, something in front of it, usually nginx, is answering first.

Why it happens

When you add a connector, ChatGPT doesn't start by calling /mcp. It first asks your server how to log in, by fetching two small JSON documents defined by the OAuth standards:

• /.well-known/oauth-protected-resource (sometimes with your MCP path on the end, like /.well-known/oauth-protected-resource/mcp): "this server is protected; here's who handles login"
• /.well-known/oauth-authorization-server: "here are the login, token and registration URLs"

Your app (Laravel, in my case) generates these. But /.well-known/ is also where Let's Encrypt and other certificate authorities place verification files. So hosting panels add an nginx rule like this:

location ~ /.well-known {
  auth_basic off;
  allow all;
}

That rule serves .well-known requests straight from disk. Since your OAuth metadata isn't a file on disk, nginx returns its own 404 page. ChatGPT gets HTML instead of JSON, gives up, and you get "couldn't connect".

It's easy to miss because your main location / rule proxies everything else to your app correctly. In nginx, regex locations (~) take priority over plain prefix locations like location /, so the .well-known rule wins.

How to confirm it in 30 seconds

curl -i https://your-domain.com/.well-known/oauth-authorization-server
curl -i https://your-domain.com/.well-known/oauth-protected-resource/mcp

You want 200 with content-type: application/json. If you see 404 with an HTML page that says nginx at the bottom, you've found the problem.

The fix

Add a more specific rule that sends only the OAuth discovery paths to your app, and place it above the generic .well-known rule. Among regex locations, nginx uses the first one that matches, in file order, so placement matters.

Here's what I use for QistPay, where the MCP server lives at /mcp:

# OAuth / MCP discovery must reach the app.
# Keep the generic .well-known rule below for SSL validation files.
location ~ ^/\.well-known/(oauth-protected-resource(?:/mcp)?|oauth-authorization-server)$ {
  proxy_pass http://127.0.0.1:8080;   # wherever your app listens
  proxy_set_header Host $host;
  proxy_set_header X-Forwarded-Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_redirect off;
}

location ~ /.well-known {
  auth_basic off;
  allow all;
}

On another project I run two MCP servers, at /mcp/admin and /mcp/merchant. There the metadata path has two extra segments, so the pattern needs to allow any suffix:

location ~ ^/\.well-known/(oauth-protected-resource|oauth-authorization-server)(/.*)?$ {
  ...same proxy settings...
}

Then test and reload:

sudo nginx -t && sudo systemctl reload nginx

Run the two curl commands again. Once they return JSON, remove and re-add the connector in ChatGPT.

Other things that cause the same error

• Other .well-known paths your app serves. Anything else your app answers under /.well-known/, like a domain-verification challenge, gets swallowed by the same rule. Add it to the pattern too.
• Wrong URLs in the metadata. The resource and issuer values in the JSON must be your public HTTPS URLs. Behind a proxy, apps often generate http://127.0.0.1:8080 instead. Set them explicitly in your config.
• CDN or cache in the way. If Cloudflare or Varnish cached the old 404, purge those two paths.
• Your hosting panel overwrites the config. Some panels, CloudPanel included, keep their own copy of each site's nginx config. If you edit the file directly, the next save in the panel can silently remove your rule. Make the change through the panel's vhost editor so it sticks.

Why this matters if you're not a developer

If you've paid for an AI connector for your product and it "doesn't work with ChatGPT", the cause is often not the AI feature itself but one line of server configuration in front of it. It's a quick fix for someone who knows where to look, and a frustrating week for someone who doesn't.