These three bugs — broken `$ref` resolution in Cline, auth header stripping in Smithery, and scanner stalls from blanket 401s — can silently break real client connections on any hosted MCP server, and the fixes are non-obvious without going through the multi-directory listing process that surfaced them.