What problem does it solve? Integrating an application with the PingOne Privilege Cloud MCP gateway involves undocumented behavior, binary-specific port models, and misleading authentication errors that can cost weeks of trial and error. This Skill consolidates verified findings about the Privilege Gateway (mcpgw), the BFF MCP client relay, and the console configuration so you can troubleshoot and extend the integration without repeating dead-end investigations. ## Core Features & Use Cases - Gateway troubleshooting: Distinguish current-binary (mcpgw) facts from historical cyonproxy findings, including correct ports (8623 vs 8620), the ValidateInfraJwt kid-mismatch rejection, and log-delta diagnosis via /var/log/procyon/cyonproxy.log. - Deployment guidance: Covers the agentless nginx front door with Host rewriting, the agent-based cloud frontend, K8s ingress configuration, and the fast-path setup with smoke-test verification via scripts/privilege-smoke.sh. - Console configuration reference: Field-by-field recipes for enrolling gateway nodes, registering MCP applications, setting upstream auth modes, and reading the real Frontend Name from the console API. - Use Case: Your tokenless POST to /mcp returns a bare 401 with no WWW-Authenticate header. Use this Skill to determine whether the gateway build, the Host routing, or the PingOne token wall is the actual cause before changing any configuration. ## Quick Start Ask the assistant to diagnose why your Privilege MCP gateway returns 401 JWT signature validation failed when sending a PingOne token.
