Client compatibility

Compatibility claims are separated from setup instructions here. The configuration recipes remain available even when a current, reproducible client test has not been retained. A route marked Not retested or Unavailable is not represented as a live interoperability result.

Review levels

Level	Meaning
Protocol implemented	The server implements the transport with the official MCP SDK and the repository contains transport, configuration, authentication, and origin checks. This is not a named-client certification.
Configuration reviewed	The setup shape was checked against the client’s published configuration documentation and this server’s runtime requirements. It has not been represented as a live interoperability test.
Client tested	The documented route connected to simplelogin-mcp, discovered the expected tool catalog, and completed the standard read-only account-usage check. This is point-in-time evidence.
Not retested	The client or route is available, but the current release candidate has not completed the full retained-evidence check. No current connection, discovery, or account-read result is claimed.
Unavailable	The client or route was not available for the current release-candidate audit. It was not tested.

Named-client matrix

MCP client	Documented route	Current evidence	Evidence scope
Codex	Local stdio	Not retested	Installed during the release-candidate audit, but not reconnected to the exact candidate. No current result is claimed.
Claude Code	Local stdio	Not retested	Installed during the release-candidate audit, but not reconnected to the exact candidate. No current result is claimed.
Claude Desktop	Local stdio	Not retested	Installed during the release-candidate audit, but not restarted against the exact candidate. No current result is claimed.
VS Code	Local stdio	Not retested	Installed but not configured for this server during the release-candidate audit. No current result is claimed.
OpenCode	Local stdio	Unavailable	No OpenCode installation was available during the release-candidate audit, so this route was not tested.
Generic MCP	Local stdio or Streamable HTTP	Implemented	Compatibility depends on the host supporting the selected transport and, for protected HTTP, a custom bearer header.

Earlier maintainer checks did not retain exact client version, platform, date, or server commit, so they are not carried forward as current test claims. The Streamable HTTP examples remain documentation-reviewed routes.

Use Client setup for the documented recipes. If a client’s configuration format changes, its current documentation remains authoritative.

Transport requirements

Local stdio clients

A compatible stdio host must be able to:

• launch a long-running child process;
• keep stdin and stdout attached to that process;
• pass TRANSPORT=stdio and SL_API_KEY as environment variables; and
• use an absolute path when launching a locally built dist/index.js.

The server writes diagnostics to stderr because stdout is reserved for MCP protocol messages.

Streamable HTTP clients

A compatible HTTP host must support the current Streamable HTTP transport and connect to POST /mcp. When MCP_AUTH_TOKEN is configured, it must also send:

Authorization: Bearer YOUR_MCP_AUTH_TOKEN

GET /health verifies that the HTTP process is running. It does not verify MCP tool discovery or the SimpleLogin API key.

Browser-based clients

Browser clients have an additional deployment requirement. The server checks Origin on POST /mcp, but it does not implement general CORS headers or OPTIONS preflights. Use a same-origin deployment or a reverse proxy that handles CORS, then add the exact browser origin to MCP_ALLOWED_ORIGINS when it is not loopback.

Evidence required for a Tested row

For each row marked Tested, retain a sanitized record of:

1. the exact client version, platform, architecture, and test date;
2. the transport and exact committed simplelogin-mcp server SHA;
3. a successful MCP connection and discovery of the complete 27-tool catalog; and
4. a successful read-only account_get_stats call without retaining account counts or data.

Never include credentials, private configuration, account data, or screenshots containing unrelated servers in the evidence.