privilege-cloud-mcp-gateway

Probe candidate ports with a tokenless MCP initialize POST request and look for a 401 response carrying a www-authenticate header. A bare 401 or generic body proves nothing, since some gateway builds return that from any port.

Gateway builds often return the same generic error text for multiple unrelated root causes like missing tokens, key-id mismatches, or no route. Tail the gateway's own log file inside the container around the failing request to see the actual internal check that failed.

The env file must contain a KEY= prefix such as ENV_PROXY_TOKEN= before the JWT; a bare token is parsed as one giant variable name with an empty value. After successful enrollment, the durable credential is an mTLS cert pair, so check container volume state before blaming token expiry.

Not necessarily; the gateway may validate against a fixed vendor-controlled trust anchor rather than your IdP's JWKS. Confirm which trust regime applies before iterating on token variants, since no token shape fixes a vendor-side inbound-trust configuration gap.

The gateway matches the inbound Host header against an exact vendor-assigned frontend name, not your public hostname. Rewrite the Host header at your nginx or ingress layer to that registered name, which you should read from the platform API rather than the console UI.