Claude.ai runs on Anthropic's infrastructure. There is no local client that you install, and therefore no machine from which the connection is established. Anthropic directly calls your MCP endpoint. The server must therefore be publicly accessible via HTTPS, with a certificate from a widely recognized CA. Internal DNS names, localhost, *.ddev.site, IP allowlists, and self-signed certificates do not work here.

Authentication is done exclusively via OAuth 2.1 with Dynamic Client Registration. A static token like in Claude Desktop does not exist in the web version. Custom connectors require a paid Claude plan (Pro, Team, or Enterprise); the free plan lacks the configuration interface.

• enableMcp is enabled (see Configuration).
• mcpAllowedRedirectUris contains claude.ai/api/mcp/auth_callback.
• mcpAllowedOrigins contains claude.ai.
• mcpAllowedClientIds remains empty. Otherwise, the client ID generated via Dynamic Client Registration must be entered manually afterwards.
• The backend group has enable_mcp_access and the required feature rights (see Permissions & Scopes).

Check the public accessibility from a machine outside your network. Both calls must return 200:

curl -sS [typo3-url]/aisuite-mcp/healthcurl -sS [typo3-url]/.well-known/oauth-authorization-server

If one of the two fails due to an IP allowlist, HTTP Basic Auth, or a self-signed certificate, Claude.ai will terminate the connection without a meaningful message. If the installation is behind Basic Auth, the MCP paths must be excluded, see Production Operation. Also, check that the Authorization header reaches PHP. On Apache with mod_php or FCGI, it is often discarded, leading to endless 401 responses after a successful OAuth flow. The necessary rewrite rule is provided by TYPO3 in the standard .htaccess.

1. Open Connector Settings. Log in to claude.ai and open the Settings via the profile icon in the top right corner, then go to Connectors. Depending on the plan, this option may also be under Feature preview.

2. Create Connector. Select Add custom connector and enter a name (for example, AI Suite) and as the server URL [typo3-url]/aisuite-mcp. Use only the root URL without site prefix; a URL like [typo3-url]/[site]/aisuite-mcp will result in a 404.

3. Connect and Agree. After clicking Connect, Claude.ai will automatically register at [typo3-url]/aisuite-mcp/oauth/register and then open a window with the authorization page. First, the normal TYPO3 backend login will follow if you are not logged in, then the consent page with the requested scopes. After confirmation, the token lands at Claude.ai, and the connector shows Connected.

4. Activate Connector per Conversation. Custom connectors are not automatically active in every chat. Open a new conversation, click on Search & tools below the input field, and enable AI Suite. Only then will the model see the tool definitions.

You can terminate access from both sides. In Claude.ai, you remove the connector; in the TYPO3 backend, you revoke the token via the MCP dashboard in the AI Suite backend module with Revoke Token.

Nothing happens when clicking Connect, and nothing is logged in TYPO3. The server is not reachable from Anthropic's network, or the certificate is not recognized (self-signed, expired, wrong hostname). Check the two curl calls from an external machine.

The model claims it has no MCP access, even though the connector is connected. The connector is not enabled in the current chat; see step 4.

The tool list remains empty. The backend user does not have AI Suite feature rights, which filters out everything in the scope check. Add rights and re-authenticate in the connector.

For debugging, the access log of the web server is the best source, as there are no viewable logs on the Claude.ai side. A 404 on /aisuite-mcp indicates a site prefix in the URL, repeated 401 indicates a missing Authorization header. A 200 at /aisuite-mcp/oauth/token should immediately be followed by a 200 at POST /aisuite-mcp. Other client-independent cases are collected under Connecting Clients.