MCP tool errors reach the agent with no status, no error code, and no isError #8572

When a platform tool returns an error through the MCP gateway, the agent sees just { "error": "credentialSecret is required: ..." }. No status code, no code, and no isError on the result, so from the agent's side the call looks like it succeeded and happened to return an object with an error key.

Forge already provides both. formatResponse in forge/ee/lib/mcp/toolLoader.js returns { content: body, code: response.statusCode, isError: true }, and the tools put a machine-readable code in the body (invalid_request, bad_request, not_found). Both get dropped somewhere between there and the agent.

Checked on the wire against a local gateway: a deliberate 400 from a tool and a 500 from the route come back looking identical. SDK-level input validation errors do keep isError: true, so it seems specific to the tool-result path.

The practical cost is that an agent can't tell "fix your arguments and retry" from "the server broke, stop retrying", which makes careful 4xx handling in the tools mostly invisible.