Fix MCP gateway auth validation and add version logging

[Copilot]

Plan: Add Gateway Version Logging and Fail on Missing Auth Headers

Requirements from Comment

The comment requests two changes:

1. Fail the MCP gateway check if authorization headers are missing - Currently only logs a warning
2. Log the gateway version in action logs for easy review

Analysis

Current Behavior (check_mcp_servers.sh lines 133-141):

• When Authorization headers are missing, it logs a WARNING but continues
• This allows servers without auth to still be checked, which may not be desired

Changes Completed

• Plan changes
• Update check_mcp_servers.sh to fail (exit 1) when Authorization headers are missing for HTTP servers
  • Changed "WARNING" to "ERROR" message
  • Increment SERVERS_FAILED counter when auth headers missing
  • Continue to next server (skip the server with missing auth)
• Add gateway version logging in start_mcp_gateway.sh after gateway output is received
  • Extract version from gateway-output.json using jq
  • Falls back to "unknown" if version not present
• Fix error propagation through tee pipe (NEW)
  • Added set -o pipefail to start_mcp_gateway.sh
  • Without this, the exit code of check_mcp_servers.sh was not propagated when piped to tee
  • Now the script correctly fails when check_mcp_servers.sh returns a non-zero exit code
• Verify all existing tests still pass (17/17 tests pass)
• Manual verification with test scenarios

Implementation Details

1. Authorization header check (check_mcp_servers.sh lines 138-143):

   • Changed from WARNING to ERROR
   • Increments SERVERS_FAILED counter
   • Continues to next server (exits loop iteration)
   • Will cause overall script to exit with code 1 (existing logic at line 342-345)

2. Gateway version logging (start_mcp_gateway.sh lines 238-241):

   • Extracts version from .gateway.version field
   • Logs "Gateway version: " or "Gateway version: unknown"
   • Placed after error checking but before conversion logic

3. Error propagation fix (start_mcp_gateway.sh line 10):

   • Added set -o pipefail to ensure pipeline failures are detected
   • Without this option, when piping to tee, only tee's exit code was checked
   • With pipefail, the exit code of check_mcp_servers.sh is properly propagated
   • This fixes the issue where failures in check_mcp_servers.sh were not causing start_mcp_gateway.sh to fail

Original prompt

Ensure that the check MCP gateway fails of any of the MCP server fails to connect

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

[github-actions]

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

[github-actions]

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

[pelikhan]

@copilot update the check MCP gateway to fail if the gateway configuration is missing authorization headers.

See https://github.com/githubnext/gh-aw/actions/runs/20884658107/job/60006066256#step:24:1

Log the gateway version in the action logs for easy review.

[Copilot]

@copilot update the check MCP gateway to fail if the gateway configuration is missing authorization headers.

See https://github.com/githubnext/gh-aw/actions/runs/20884658107/job/60006066256#step:24:1...

Done in commit 8174f0f.

Changes:

1. MCP check now fails when Authorization headers are missing: Changed from WARNING to ERROR and increments SERVERS_FAILED counter, causing the script to exit with code 1
2. Gateway version now logged: Displays "Gateway version: " in action logs after gateway output is validated

Both changes tested and verified. All 17 existing tests still pass.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/githubnext/gh-aw/actions/runs/20884658107
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[github-actions]

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

[github-actions]

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

[github-actions]

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[pelikhan]

@copilot Review how the check_mcp_gateway is invoked . The error is not progapated as one can see in https://github.com/githubnext/gh-aw/actions/runs/20884936058/job/60006717966#step:24:1

It is probably the piping to a log file.