[Bug]: the gateway rejects unauthorized tools/call with a raw HTTP 403

[jhivandb]

Please select the area the issue is related to

Gateway

Please select the aspect the issue is related to

Aspect/AI (AI/LLM integration, MCP, AI readiness)

Description

mcp SDK vs gateway denials: the gateway rejects unauthorized tools/call with a raw HTTP 403, which the Python MCP SDK treats as a fatal transport error.

Error also says "invalid_token" and not "insufficient_scope"

HTTP/1.1 403 Forbidden
  content-type: application/json
  www-authenticate: Bearer
  resource_metadata="http://localhost:19080/booking/.well-known/oauth-protected-resource",
                    scope="booking:write", error="invalid_token",
                    error_description="Forbidden: insufficient permissions to access this MCP
  resource"

  {"error":"Forbidden","message":"Forbidden: insufficient permissions to access this MCP
  resource"}

Python mcp client expects something like: (This isn't defined in the mcp spec)

{"jsonrpc": "2.0", "id": 4, "error": {"code": -32603,
    "message": "Forbidden: insufficient permissions (requires scope booking:write)",
    "data": {"required_scope": "booking:write"}}}

Steps to Reproduce

1. token_issuer with scopes
2. configure api-platform with token_issuer a
3. mcp route with mcp_auth and mcp_authz policies
4. configure the authz policy to require to access a tool
5. Invoke the mcp and formerly defined tool with a token without the scopes required.
6. profit?

Severity Level of the Issue

Severity/Blocker (Core functionality is broken and consumer is blocked. Need immediate attention)

Environment Details (with versions)

Agent-manager:main
Gateway product: v1.0.0
Client: Python mcp sdk