You run your own agent: a Slack bot, a service on a VPS, an MCP client you wrote over a weekend. You want it on your files, which on Stream Vessel means your own S3 bucket, where an agent can read, write and delete through the MCP server. The agent speaks MCP’s standard OAuth sign-in: it registers itself, opens a browser, you click Approve, it gets a token.
It fails at step one. At registration the agent named its redirect URI, the address your browser returns to after you approve, carrying a one-time authorization code the agent swaps for a token. Yours is https://agent.yourhost.example/callback; the answer is invalid_redirect_uri. The server only accepts addresses on its operator’s allowlist: Claude, ChatGPT, Cursor, VS Code and a few others. Getting yours added means asking the operator to change a config file.
