Can't connect Claude to the MCP

[Toys0125]

When ever Claude tries to auth the server it fails and the server prints out this.

{"ts":"2026-07-11T06:54:47.036Z","level":"info","event":"http_request","requestId":"5d7e10cb-e8bb-4954-8d80-f7c396a6c8a7","method":"GET","path":"/","status":200,"durationMs":1,"ip":"127.0.0.1","host":"example.com","userAgent":"python-httpx/0.28.1"}
ValidationError: The 'X-Forwarded-For' header is set but the Express 'trust proxy' setting is false (default). This could indicate a misconfiguration which would prevent express-rate-limit from accurately identifying users. See https://express-rate-limit.github.io/ERR_ERL_UNEXPECTED_X_FORWARDED_FOR/ for more information.
    at Object.xForwardedForHeader (file:///home/ubuntu/.local/share/pi-node/node-v22.23.0-linux-arm64/lib/node_modules/@waishnav/devspace/node_modules/express-rate-limit/dist/index.mjs:352:13)
    at wrappedValidations.<computed> [as xForwardedForHeader] (file:///home/ubuntu/.local/share/pi-node/node-v22.23.0-linux-arm64/lib/node_modules/@waishnav/devspace/node_modules/express-rate-limit/dist/index.mjs:675:22)
    at Object.keyGenerator (file:///home/ubuntu/.local/share/pi-node/node-v22.23.0-linux-arm64/lib/node_modules/@waishnav/devspace/node_modules/express-rate-limit/dist/index.mjs:782:20)
    at file:///home/ubuntu/.local/share/pi-node/node-v22.23.0-linux-arm64/lib/node_modules/@waishnav/devspace/node_modules/express-rate-limit/dist/index.mjs:864:32
    at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
    at async file:///home/ubuntu/.local/share/pi-node/node-v22.23.0-linux-arm64/lib/node_modules/@waishnav/devspace/node_modules/express-rate-limit/dist/index.mjs:825:5 {
  code: 'ERR_ERL_UNEXPECTED_X_FORWARDED_FOR',
  help: 'https://express-rate-limit.github.io/ERR_ERL_UNEXPECTED_X_FORWARDED_FOR/'
}
{"ts":"2026-07-11T06:54:47.199Z","level":"info","event":"http_request","requestId":"a6202465-804f-4e1e-be63-f441c915e4d5","method":"POST","path":"/","status":400,"durationMs":7,"ip":"127.0.0.1","host":"example.com","userAgent":"python-httpx/0.28.1","contentLength":"257"}
{"ts":"2026-07-11T06:54:48.784Z","level":"info","event":"http_request","requestId":"907196dd-97aa-405f-b944-30d3581546ff","method":"POST","path":"/mcp","status":401,"durationMs":1,"ip":"127.0.0.1","host":"example.com","userAgent":"Claude-User","contentLength":"254"}

[lavalava45]

I can reproduce this too with ChatGPT Dev Mode + Cloudflare Quick Tunnel.

Environment:

• Windows 11
• Node v24.13.0
• @waishnav/devspace 1.0.4
• cloudflared quick tunnel to http://127.0.0.1:7676
• ChatGPT developer app URL: https://.trycloudflare.com/mcp

During OAuth authorization, DevSpace logs the same error:

ERR_ERL_UNEXPECTED_X_FORWARDED_FOR

The request reaches DevSpace:

• GET / status 200
• POST / status 302 or fails during authorization
• Host is the trycloudflare.com hostname

This seems to be caused by express-rate-limit receiving X-Forwarded-For while Express has default trust proxy = false.

A likely fix is setting Express trust proxy before rateLimit middleware, e.g.:

app.set("trust proxy", 1)

or configuring express-rate-limit with a proxy-aware keyGenerator/validation setting.