AGENT RESCUE DESK ILLUSTRATIVE RESCUE PACKET S-001 Updated July 27, 2026 TRANSPARENCY NOTICE This is a synthetic example. It is not a customer case, testimonial, or claim of past work. Every system, hostname, log line, identifier, and result below is fictional and intentionally non-operational. The method and acceptance criteria are representative of a fixed-scope Agent Rescue Desk handoff. 01 — ACCEPTED BRIEF Starting symptom: The local MCP tool works, but the deployed agent reports that no support tool is available. Bounded workflow: Classify one synthetic support request, call create_test_ticket, and return its ticket reference. Acceptance criterion: A production-hosted run creates exactly one sandbox ticket containing trace ARD-SYNTHETIC-20260727, and the agent returns the same reference. Authorized changes: Production gateway configuration, MCP route configuration, and one non-destructive smoke test. Inside scope: Transport routing, protocol initialization, tool discovery, direct sandbox execution, and the agent's final tool-selection path. Outside scope: New tools, prompt redesign beyond the failing path, production customer data, UI work, and ongoing monitoring. 02 — REPRODUCTION The same fictional server package and tool schema are exercised through two paths. The local stdio path initializes and lists the target tool. The production Streamable HTTP path returns a web document before the MCP server receives the request. Check Local Production Meaning Artifact Match Match Same commit and lockfile DNS + TLS N/A Pass Host and certificate valid POST /mcp JSON-RPC 200 text/html Gateway responds first Origin request log Initialize seen No request Failure precedes server Tool discovery 3 tools Blocked Negotiation never begins Redacted synthetic trace: 00:00.000 POST https://agent.example.invalid/mcp 00:00.041 HTTP 200 00:00.041 content-type: text/html; charset=utf-8 00:00.042 body-prefix: 00:00.043 mcp-origin request count: 0 00:00.044 client: invalid JSON-RPC response 03 — ROOT CAUSE The production gateway evaluates its single-page application fallback before the MCP upstream rule. Any unmatched path, including POST /mcp, receives the application shell with status 200. The local stdio path bypasses that gateway, which explains why the same server appears healthy locally. Agent client -> POST /mcp -> SPA fallback wins -> MCP origin never reached A successful HTTP status is not sufficient evidence. The response media type, JSON-RPC exchange, tool execution, and downstream effect must each be verified. 04 — AGREED REPAIRS 1. Route the MCP endpoint before the application fallback. The explicit /mcp upstream rule now precedes the catch-all web route and accepts only the methods required by the server. 2. Preserve the transport contract through the gateway. The gateway forwards the request method, Content-Type, Accept, and MCP session header, disables response rewriting, and allows the configured streaming duration. 3. Add a deploy-time production smoke. A credential-scoped sandbox check initializes the server, confirms the target tool schema, calls it once with the unique trace, and verifies the resulting sandbox record. 05 — END-TO-END VERIFICATION PASS Transport POST /mcp reaches the origin and returns an allowed MCP response type. PASS Protocol initialize completes with the expected protocol version and server identity. PASS Discovery tools/list contains create_test_ticket with the expected input schema. PASS Direct execution The tool creates one sandbox ticket carrying trace ARD-SYNTHETIC-20260727. PASS Agent control The deployed agent selects the tool for the accepted synthetic request without a manual tool override. PASS User-visible result The agent returns the exact ticket reference and the sandbox record is independently readable. Acceptance result: VERIFIED REPAIR One synthetic request -> one tool call -> one sandbox ticket -> one matching reference. 06 — ROLLBACK 1. Restore the versioned gateway configuration from the pre-change artifact. 2. Redeploy the prior gateway release; leave the MCP service unchanged. 3. Run the read-only transport probe and confirm the prior route is restored. 4. Delete the synthetic sandbox ticket created by the smoke. The sample change does not alter schemas, production records, authorization policy, or long-lived credentials. 07 — RESIDUAL RISKS AND HANDOFF Closed: The production MCP route reaches the intended origin and the accepted agent path passes end to end. Still external: Identity-provider, model-provider, and hosting outages remain outside the repaired route. Watch: Run the smoke after gateway, MCP SDK, model, auth, or client transport changes. Escalate if: Discovery passes but direct execution or the final sandbox record fails. That is a different layer and requires a new diagnosis. Access closeout: - Temporary sandbox credential revoked after verification. - Synthetic ticket removed after evidence capture. - Logs retained only in redacted form; raw tokens never enter the packet. - Customer rotates any credential shared outside its normal access system. — Agent Rescue Desk https://agent-rescue-desk.netlify.app/ Independent, fixed-scope technical recovery for AI agent workflows.