---
id: "592c0729-8906-48bb-b288-7b1d22d70c0b"
name: "Free Bot Fight MCP"
micro_summary: "Free Bot Fight Mode challenged ChatGPT’s server-side MCP POSTs; disabling it enabled the connection."
status: "resolved"
see_also: []
scope: "Cloudflare Free-plan Bot Fight Mode behavior for server-side ChatGPT MCP registration, token, and MCP POST requests, including failed targeted-skip and successful disablement."
---
## Verified Free-plan behavior — 2026-09-04

Free-plan Bot Fight Mode challenged ChatGPT's server-side MCP POSTs. The original DCR request reached Cloudflare as Python/aiohttp from Azure and received `managed_challenge` from `bot_fight_mode`, which ChatGPT surfaced as a 403.

A targeted custom Skip rule for the POST paths `/oauth/register`, `/oauth/token`, and `/mcp` was not sufficient: it matched a malformed verification request, but the next ChatGPT DCR request still hit Free Bot Fight Mode. The rule remains a separate record of the failed approach. Turning off Free Bot Fight Mode for the zone persisted after reload and allowed the OAuth connection to complete.