[aw-failures] [aw-fix] P1: MCP Inspector Agent — Start MCP Gateway hard-fails (exit 1) on datadog MCP `403 Forbidden`

[github-actions]

Fix the MCP Inspector gateway so one unreachable server (datadog 403 Forbidden) can't hard-fail startup — today it exits 1 and takes the whole agent job down deterministically.

Parent: #46171

Problem statement

The MCP Inspector Agent workflow fails at the Start MCP Gateway step with Process completed with exit code 1. During launcher startup the datadog MCP server rejects the initialize handshake with HTTP 403 Forbidden across all three transports (streamable HTTP, SSE, plain JSON-RPC), the launcher records the server error, then the gateway process exits 1 after the network-connectivity diagnostic — even though the gateway port (127.0.0.1:8080) is listening. This is deterministic (a 403 on initialize recurs every run), not transient.

Affected workflows and run IDs

• Workflow: MCP Inspector Agent (.github/workflows/mcp-inspector.lock.yml)
• Failing run: §29770927744 — 2026-07-20T19:11:06Z, job agent, step Start MCP Gateway
• Frequency: 1/1 recent runs failed (only run in the last 6h; no successful comparator exists)

Probable root cause

The datadog MCP endpoint ((mcp.datadoghq.com/redacted) returns 403 {"errors":["Forbidden"]}oninitialize — an expired/invalid/unauthorized credential (DD_*token) or an endpoint that no longer accepts the configured auth. Because the gateway treats a configured server's failed connect as fatal, the entireStart MCP Gateway` step exits 1 instead of degrading gracefully.

Proposed remediation

1. Fix the credential — rotate/re-scope the datadog MCP token so initialize returns 200 (verify the unstable/mcp-server endpoint still accepts it).
2. Make startup resilient (preferred) — a single non-critical MCP server failing to connect should degrade to a warning, not exit 1. Skip/mark the datadog server unavailable and let the gateway continue with the servers that did connect (github + context7 were healthy). Optionally gate hard-fail behind an explicit required: true per-server flag.

Success criteria / verification

• MCP Inspector Agent completes with the agent job success (or a non-fatal warning) when datadog is unreachable.
• If datadog remains configured, its initialize returns 200 and it registers tools; otherwise the gateway logs a skipped-server warning and exits 0.
• Re-run the workflow: Start MCP Gateway no longer exits 1 solely because one server returned 403.
  Related to [aw-failures] [aw] Failure Investigator (6h) - Issue Group #46171

Generated by 🔍 [aw] Failure Investigator (6h) · 89.6 AIC · ⌖ 34.3 AIC · ⊞ 5.2K · ◷

• expires on Jul 27, 2026, 11:25 AM UTC-08:00

[pelikhan]

@copilot implement option 2