> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshoot the hosted MCP server

> Fix common connection, permission, and plan errors when you use the hosted MCP server for Semgrep AppSec Platform.

Use this page to fix common errors when you connect an MCP client to the hosted MCP server or call its tools.

## The connection fails with "Invalid or expired bearer token"

The client receives a `401` error. The token was revoked, was created in a different deployment than the server URL, or has the **Member** scope.

To fix this, use a token with the **Web API** scope from the same deployment as the server URL, or connect with OAuth.

## Only the `semgrep_account` tool appears

The connection isn't tied to an organization that can use the hosted MCP server. Either your organization is on the Free plan, or you connected with a token that isn't bound to an organization.

To fix this, connect to an organization on a Teams or Enterprise plan. If you use an API token, create it in that organization's [**Settings > Tokens > API tokens**](https://semgrep.dev/orgs/-/settings/tokens/api).

## A tool returns "status 404: The requested URL was not found"

Your token or role doesn't have the permission that the tool requires. The hosted MCP server reports permission denials as `404`, not `403`, even for an organization you belong to.

To fix this, check [Token scopes](https://docs.semgrep.dev/mcp/authentication.md#token-scopes), or switch to a **Web API** token or OAuth.

## Autofix returns `AUTOFIX_ERROR_TYPE_PERMISSION_DENIED`

**Read-only** tokens can't open Autofix pull requests. Use a **Web API** token or OAuth.

## A tool returns "Please upgrade your plan" or "Writes through this API are not yet enabled"

Your organization's plan or feature settings don't include this operation. Changing the token doesn't fix this error. Contact your Semgrep account team.

## A capability you expect is missing

If you connected to the [read-only URL](https://docs.semgrep.dev/mcp/authentication.md#read-only-url), tools that make changes aren't available. To triage findings, generate fixes, or start scans, connect to the full MCP server URL instead.

If you expect the `semgrep_run_job` tool, check that your client supports the MCP tasks extension. See [Run scans and workflows](https://docs.semgrep.dev/mcp/run-scans-and-workflows.md#prerequisites).

Not every AppSec Platform feature is available through the hosted MCP server. To request a capability, contact [Semgrep support](https://docs.semgrep.dev/support.md).