From 2769c2861136d2ab0d3dd801f6df9676e680d3a7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 19 May 2026 19:21:44 +0000
Subject: [PATCH 01/15] Initial plan


From 5008ef4d46470d9a58339ca581066f22cef87061 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 19 May 2026 19:35:14 +0000
Subject: [PATCH 02/15] Align MCP network schema with proxy-args runtime
 behavior

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/bb828f4c-1448-4e43-821c-f279e0b925db

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
---
 pkg/parser/schema_test.go                    | 98 ++++++++++++++++++++
 pkg/parser/schemas/main_workflow_schema.json | 10 +-
 pkg/parser/schemas/mcp_config_schema.json    |  6 +-
 3 files changed, 106 insertions(+), 8 deletions(-)

diff --git a/pkg/parser/schema_test.go b/pkg/parser/schema_test.go
index b227cffaf43..7bc2d81befd 100644
--- a/pkg/parser/schema_test.go
+++ b/pkg/parser/schema_test.go
@@ -264,6 +264,104 @@ func TestValidateMCPConfigWithSchema(t *testing.T) {
 	}
 }
 
+func TestMCPNetworkSchemaProxyArgsContract(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name          string
+		schemaPath    string
+		networkGetter func(map[string]any) map[string]any
+	}{
+		{
+			name:       "main workflow schema stdio_mcp_tool.network",
+			schemaPath: "schemas/main_workflow_schema.json",
+			networkGetter: func(schema map[string]any) map[string]any {
+				defs, ok := schema["$defs"].(map[string]any)
+				if !ok {
+					return nil
+				}
+				stdioTool, ok := defs["stdio_mcp_tool"].(map[string]any)
+				if !ok {
+					return nil
+				}
+				props, ok := stdioTool["properties"].(map[string]any)
+				if !ok {
+					return nil
+				}
+				network, ok := props["network"].(map[string]any)
+				if !ok {
+					return nil
+				}
+				return network
+			},
+		},
+		{
+			name:       "mcp config schema network",
+			schemaPath: "schemas/mcp_config_schema.json",
+			networkGetter: func(schema map[string]any) map[string]any {
+				props, ok := schema["properties"].(map[string]any)
+				if !ok {
+					return nil
+				}
+				network, ok := props["network"].(map[string]any)
+				if !ok {
+					return nil
+				}
+				return network
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			schemaContent, err := os.ReadFile(tt.schemaPath)
+			if err != nil {
+				t.Fatalf("failed to read schema: %v", err)
+			}
+
+			var schema map[string]any
+			if err := json.Unmarshal(schemaContent, &schema); err != nil {
+				t.Fatalf("failed to parse schema json: %v", err)
+			}
+
+			network := tt.networkGetter(schema)
+			if network == nil {
+				t.Fatal("network schema not found")
+			}
+
+			if deprecatedValue, hasDeprecated := network["deprecated"]; hasDeprecated {
+				if deprecatedBool, ok := deprecatedValue.(bool); !ok || deprecatedBool {
+					t.Fatalf("network field should not be deprecated; got deprecated=%v", deprecatedValue)
+				}
+			}
+
+			description, ok := network["description"].(string)
+			if !ok {
+				t.Fatal("network description not found")
+			}
+			if !strings.Contains(description, "proxy-args") {
+				t.Fatalf("network description should mention proxy-args support, got: %q", description)
+			}
+			if strings.Contains(strings.ToLower(description), "field is ignored") {
+				t.Fatalf("network description must not claim the entire field is ignored, got: %q", description)
+			}
+
+			properties, ok := network["properties"].(map[string]any)
+			if !ok {
+				t.Fatal("network properties not found")
+			}
+			allowedField, ok := properties["allowed"].(map[string]any)
+			if !ok {
+				t.Fatal("network.allowed schema not found")
+			}
+			deprecatedAllowed, ok := allowedField["deprecated"].(bool)
+			if !ok || !deprecatedAllowed {
+				t.Fatalf("network.allowed should be marked deprecated; got: %v", allowedField["deprecated"])
+			}
+		})
+	}
+}
+
 func TestValidateMainWorkflowFrontmatterWithSchemaAndLocation_WorkflowDispatchNumberInputType(t *testing.T) {
 	t.Parallel()
 
diff --git a/pkg/parser/schemas/main_workflow_schema.json b/pkg/parser/schemas/main_workflow_schema.json
index 76cfd3e168d..127c23993ca 100644
--- a/pkg/parser/schemas/main_workflow_schema.json
+++ b/pkg/parser/schemas/main_workflow_schema.json
@@ -10725,11 +10725,11 @@
         },
         "network": {
           "type": "object",
-          "deprecated": true,
-          "$comment": "DEPRECATED: Per-server network configuration is no longer supported. Use top-level workflow 'network:' configuration instead.",
+          "$comment": "Per-server network settings for stdio MCP tools. Use 'network.proxy-args' for per-server proxy arguments; 'network.allowed' is deprecated and ignored.",
           "properties": {
             "allowed": {
               "type": "array",
+              "deprecated": true,
               "items": {
                 "type": "string",
                 "pattern": "^[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*$",
@@ -10737,7 +10737,7 @@
               },
               "minItems": 1,
               "uniqueItems": true,
-              "description": "List of allowed domain names for network access",
+              "description": "DEPRECATED: Per-server allowed domains are ignored. Use top-level workflow 'network.allowed' instead.",
               "maxItems": 100
             },
             "proxy-args": {
@@ -10749,7 +10749,7 @@
             }
           },
           "additionalProperties": false,
-          "description": "DEPRECATED: Per-server network configuration is no longer supported. Use top-level workflow 'network:' configuration instead. This field is ignored and will be removed in a future version."
+          "description": "Per-server network configuration for stdio MCP tools. Supports 'proxy-args' for container proxy arguments."
         },
         "allowed": {
           "type": "array",
@@ -10768,7 +10768,7 @@
         }
       },
       "additionalProperties": false,
-      "$comment": "Validation constraints: (1) Mutual exclusion: 'command' and 'container' cannot both be specified. (2) Requirement: Either 'command' or 'container' must be provided (via 'anyOf'). (3) Type constraint: When 'type' is 'stdio' or 'local', either 'command' or 'container' is required. Note: Per-server 'network' field is deprecated and ignored.",
+      "$comment": "Validation constraints: (1) Mutual exclusion: 'command' and 'container' cannot both be specified. (2) Requirement: Either 'command' or 'container' must be provided (via 'anyOf'). (3) Type constraint: When 'type' is 'stdio' or 'local', either 'command' or 'container' is required. Note: In per-server 'network', only 'proxy-args' is supported; 'network.allowed' is deprecated and ignored.",
       "anyOf": [
         {
           "required": ["type"]
diff --git a/pkg/parser/schemas/mcp_config_schema.json b/pkg/parser/schemas/mcp_config_schema.json
index 3aea970ec40..f7601e5374a 100644
--- a/pkg/parser/schemas/mcp_config_schema.json
+++ b/pkg/parser/schemas/mcp_config_schema.json
@@ -149,10 +149,10 @@
     },
     "network": {
       "type": "object",
-      "deprecated": true,
       "properties": {
         "allowed": {
           "type": "array",
+          "deprecated": true,
           "items": {
             "type": "string",
             "pattern": "^[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*$",
@@ -160,7 +160,7 @@
           },
           "minItems": 1,
           "uniqueItems": true,
-          "description": "List of allowed domain names for network access",
+          "description": "DEPRECATED: Per-server allowed domains are ignored. Use top-level workflow 'network.allowed' instead.",
           "examples": [
             ["github.com", "api.github.com"],
             ["example.com", "api.example.com", "cdn.example.com"]
@@ -179,7 +179,7 @@
         }
       },
       "additionalProperties": false,
-      "description": "DEPRECATED: Per-server network configuration is no longer supported. Use top-level workflow 'network:' configuration instead. This field is ignored and will be removed in a future version.",
+      "description": "Per-server network configuration for stdio MCP tools. Supports 'proxy-args' for container proxy arguments.",
       "examples": [
         {
           "allowed": ["github.com", "api.github.com"]

From 9ad07b5bd8e494de803856ebe75354bec20cad88 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 19 May 2026 19:37:44 +0000
Subject: [PATCH 03/15] Harden schema contract test for embedded parser schemas

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/bb828f4c-1448-4e43-821c-f279e0b925db

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
---
 pkg/parser/schema_test.go | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/pkg/parser/schema_test.go b/pkg/parser/schema_test.go
index 7bc2d81befd..3f24712c7a1 100644
--- a/pkg/parser/schema_test.go
+++ b/pkg/parser/schema_test.go
@@ -269,12 +269,12 @@ func TestMCPNetworkSchemaProxyArgsContract(t *testing.T) {
 
 	tests := []struct {
 		name          string
-		schemaPath    string
+		rawSchema     string
 		networkGetter func(map[string]any) map[string]any
 	}{
 		{
-			name:       "main workflow schema stdio_mcp_tool.network",
-			schemaPath: "schemas/main_workflow_schema.json",
+			name:      "main workflow schema stdio_mcp_tool.network",
+			rawSchema: mainWorkflowSchema,
 			networkGetter: func(schema map[string]any) map[string]any {
 				defs, ok := schema["$defs"].(map[string]any)
 				if !ok {
@@ -296,8 +296,8 @@ func TestMCPNetworkSchemaProxyArgsContract(t *testing.T) {
 			},
 		},
 		{
-			name:       "mcp config schema network",
-			schemaPath: "schemas/mcp_config_schema.json",
+			name:      "mcp config schema network",
+			rawSchema: mcpConfigSchema,
 			networkGetter: func(schema map[string]any) map[string]any {
 				props, ok := schema["properties"].(map[string]any)
 				if !ok {
@@ -314,13 +314,8 @@ func TestMCPNetworkSchemaProxyArgsContract(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			schemaContent, err := os.ReadFile(tt.schemaPath)
-			if err != nil {
-				t.Fatalf("failed to read schema: %v", err)
-			}
-
 			var schema map[string]any
-			if err := json.Unmarshal(schemaContent, &schema); err != nil {
+			if err := json.Unmarshal([]byte(tt.rawSchema), &schema); err != nil {
 				t.Fatalf("failed to parse schema json: %v", err)
 			}
 
@@ -330,7 +325,11 @@ func TestMCPNetworkSchemaProxyArgsContract(t *testing.T) {
 			}
 
 			if deprecatedValue, hasDeprecated := network["deprecated"]; hasDeprecated {
-				if deprecatedBool, ok := deprecatedValue.(bool); !ok || deprecatedBool {
+				deprecatedBool, ok := deprecatedValue.(bool)
+				if !ok {
+					t.Fatalf("network.deprecated should be a boolean when present; got %T", deprecatedValue)
+				}
+				if deprecatedBool {
 					t.Fatalf("network field should not be deprecated; got deprecated=%v", deprecatedValue)
 				}
 			}

From ab65774684b668b65cbca9a6eee90627e8441b5d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 19 May 2026 19:41:11 +0000
Subject: [PATCH 04/15] Clarify network schema description and tighten contract
 assertions

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/bb828f4c-1448-4e43-821c-f279e0b925db

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
---
 pkg/parser/schema_test.go                    | 6 +++++-
 pkg/parser/schemas/main_workflow_schema.json | 2 +-
 pkg/parser/schemas/mcp_config_schema.json    | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkg/parser/schema_test.go b/pkg/parser/schema_test.go
index 3f24712c7a1..49d0ea1e41f 100644
--- a/pkg/parser/schema_test.go
+++ b/pkg/parser/schema_test.go
@@ -264,7 +264,7 @@ func TestValidateMCPConfigWithSchema(t *testing.T) {
 	}
 }
 
-func TestMCPNetworkSchemaProxyArgsContract(t *testing.T) {
+func TestMCPNetworkSchemaProxyArgsSupportAndAllowedDeprecation(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
@@ -344,6 +344,10 @@ func TestMCPNetworkSchemaProxyArgsContract(t *testing.T) {
 			if strings.Contains(strings.ToLower(description), "field is ignored") {
 				t.Fatalf("network description must not claim the entire field is ignored, got: %q", description)
 			}
+			descriptionLower := strings.ToLower(description)
+			if !strings.Contains(descriptionLower, "allowed") || !strings.Contains(descriptionLower, "ignored") {
+				t.Fatalf("network description should mention that 'allowed' is ignored, got: %q", description)
+			}
 
 			properties, ok := network["properties"].(map[string]any)
 			if !ok {
diff --git a/pkg/parser/schemas/main_workflow_schema.json b/pkg/parser/schemas/main_workflow_schema.json
index 127c23993ca..35c44537230 100644
--- a/pkg/parser/schemas/main_workflow_schema.json
+++ b/pkg/parser/schemas/main_workflow_schema.json
@@ -10749,7 +10749,7 @@
             }
           },
           "additionalProperties": false,
-          "description": "Per-server network configuration for stdio MCP tools. Supports 'proxy-args' for container proxy arguments."
+          "description": "Per-server network configuration for stdio MCP tools. Supports 'proxy-args' for container proxy arguments. The 'allowed' field is deprecated and ignored."
         },
         "allowed": {
           "type": "array",
diff --git a/pkg/parser/schemas/mcp_config_schema.json b/pkg/parser/schemas/mcp_config_schema.json
index f7601e5374a..d5128372baf 100644
--- a/pkg/parser/schemas/mcp_config_schema.json
+++ b/pkg/parser/schemas/mcp_config_schema.json
@@ -179,7 +179,7 @@
         }
       },
       "additionalProperties": false,
-      "description": "Per-server network configuration for stdio MCP tools. Supports 'proxy-args' for container proxy arguments.",
+      "description": "Per-server network configuration for stdio MCP tools. Supports 'proxy-args' for container proxy arguments. The 'allowed' field is deprecated and ignored.",
       "examples": [
         {
           "allowed": ["github.com", "api.github.com"]

From 60c2742c93c15ddc0c58f37282289cf48a426db6 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 19 May 2026 19:43:38 +0000
Subject: [PATCH 05/15] Refine schema contract test assertions for network
 deprecation semantics

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/bb828f4c-1448-4e43-821c-f279e0b925db

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
---
 pkg/parser/schema_test.go | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/pkg/parser/schema_test.go b/pkg/parser/schema_test.go
index 49d0ea1e41f..d537a64ba03 100644
--- a/pkg/parser/schema_test.go
+++ b/pkg/parser/schema_test.go
@@ -324,7 +324,8 @@ func TestMCPNetworkSchemaProxyArgsSupportAndAllowedDeprecation(t *testing.T) {
 				t.Fatal("network schema not found")
 			}
 
-			if deprecatedValue, hasDeprecated := network["deprecated"]; hasDeprecated {
+			deprecatedValue, hasDeprecated := network["deprecated"]
+			if hasDeprecated {
 				deprecatedBool, ok := deprecatedValue.(bool)
 				if !ok {
 					t.Fatalf("network.deprecated should be a boolean when present; got %T", deprecatedValue)
@@ -333,6 +334,9 @@ func TestMCPNetworkSchemaProxyArgsSupportAndAllowedDeprecation(t *testing.T) {
 					t.Fatalf("network field should not be deprecated; got deprecated=%v", deprecatedValue)
 				}
 			}
+			if hasDeprecated {
+				t.Fatalf("network.deprecated should be absent from schema, got: %v", deprecatedValue)
+			}
 
 			description, ok := network["description"].(string)
 			if !ok {
@@ -341,10 +345,16 @@ func TestMCPNetworkSchemaProxyArgsSupportAndAllowedDeprecation(t *testing.T) {
 			if !strings.Contains(description, "proxy-args") {
 				t.Fatalf("network description should mention proxy-args support, got: %q", description)
 			}
-			if strings.Contains(strings.ToLower(description), "field is ignored") {
-				t.Fatalf("network description must not claim the entire field is ignored, got: %q", description)
-			}
 			descriptionLower := strings.ToLower(description)
+			disallowedPhrases := []string{
+				"per-server network configuration is no longer supported",
+				"this field is ignored",
+			}
+			for _, phrase := range disallowedPhrases {
+				if strings.Contains(descriptionLower, phrase) {
+					t.Fatalf("network description must not claim the entire field is ignored/deprecated, got: %q", description)
+				}
+			}
 			if !strings.Contains(descriptionLower, "allowed") || !strings.Contains(descriptionLower, "ignored") {
 				t.Fatalf("network description should mention that 'allowed' is ignored, got: %q", description)
 			}

From f986447d3dccd7e6557b89fd8e2854693ab606d7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 19 May 2026 19:46:01 +0000
Subject: [PATCH 06/15] Simplify network deprecation contract assertion

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/bb828f4c-1448-4e43-821c-f279e0b925db

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
---
 pkg/parser/schema_test.go | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/pkg/parser/schema_test.go b/pkg/parser/schema_test.go
index d537a64ba03..dfc96396f4c 100644
--- a/pkg/parser/schema_test.go
+++ b/pkg/parser/schema_test.go
@@ -324,17 +324,7 @@ func TestMCPNetworkSchemaProxyArgsSupportAndAllowedDeprecation(t *testing.T) {
 				t.Fatal("network schema not found")
 			}
 
-			deprecatedValue, hasDeprecated := network["deprecated"]
-			if hasDeprecated {
-				deprecatedBool, ok := deprecatedValue.(bool)
-				if !ok {
-					t.Fatalf("network.deprecated should be a boolean when present; got %T", deprecatedValue)
-				}
-				if deprecatedBool {
-					t.Fatalf("network field should not be deprecated; got deprecated=%v", deprecatedValue)
-				}
-			}
-			if hasDeprecated {
+			if deprecatedValue, hasDeprecated := network["deprecated"]; hasDeprecated {
 				t.Fatalf("network.deprecated should be absent from schema, got: %v", deprecatedValue)
 			}
 

From 0d9254bf4c04ee1f1ad8f338935153325735df0a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 19 May 2026 19:48:18 +0000
Subject: [PATCH 07/15] Rename MCP network schema test for clarity

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/bb828f4c-1448-4e43-821c-f279e0b925db

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
---
 pkg/parser/schema_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/parser/schema_test.go b/pkg/parser/schema_test.go
index dfc96396f4c..df9cf2360c2 100644
--- a/pkg/parser/schema_test.go
+++ b/pkg/parser/schema_test.go
@@ -264,7 +264,7 @@ func TestValidateMCPConfigWithSchema(t *testing.T) {
 	}
 }
 
-func TestMCPNetworkSchemaProxyArgsSupportAndAllowedDeprecation(t *testing.T) {
+func TestMCPNetworkSchemaDeprecation(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {

From b7016debc53833b6099157db80a2b35e44707591 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 19 May 2026 19:50:46 +0000
Subject: [PATCH 08/15] Simplify schema wording assertions to positive contract
 checks

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/bb828f4c-1448-4e43-821c-f279e0b925db

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
---
 pkg/parser/schema_test.go | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/pkg/parser/schema_test.go b/pkg/parser/schema_test.go
index df9cf2360c2..e24faf884a4 100644
--- a/pkg/parser/schema_test.go
+++ b/pkg/parser/schema_test.go
@@ -336,15 +336,6 @@ func TestMCPNetworkSchemaDeprecation(t *testing.T) {
 				t.Fatalf("network description should mention proxy-args support, got: %q", description)
 			}
 			descriptionLower := strings.ToLower(description)
-			disallowedPhrases := []string{
-				"per-server network configuration is no longer supported",
-				"this field is ignored",
-			}
-			for _, phrase := range disallowedPhrases {
-				if strings.Contains(descriptionLower, phrase) {
-					t.Fatalf("network description must not claim the entire field is ignored/deprecated, got: %q", description)
-				}
-			}
 			if !strings.Contains(descriptionLower, "allowed") || !strings.Contains(descriptionLower, "ignored") {
 				t.Fatalf("network description should mention that 'allowed' is ignored, got: %q", description)
 			}

From 67685d0dcd27422d71e829e08d2cddbbdb10118b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 19 May 2026 19:53:12 +0000
Subject: [PATCH 09/15] Strengthen MCP network schema regression test coverage

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/bb828f4c-1448-4e43-821c-f279e0b925db

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
---
 pkg/parser/schema_test.go | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkg/parser/schema_test.go b/pkg/parser/schema_test.go
index e24faf884a4..f179f987540 100644
--- a/pkg/parser/schema_test.go
+++ b/pkg/parser/schema_test.go
@@ -264,7 +264,7 @@ func TestValidateMCPConfigWithSchema(t *testing.T) {
 	}
 }
 
-func TestMCPNetworkSchemaDeprecation(t *testing.T) {
+func TestMCPNetworkSchemaAllowedDeprecationOnly(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
@@ -344,6 +344,7 @@ func TestMCPNetworkSchemaDeprecation(t *testing.T) {
 			if !ok {
 				t.Fatal("network properties not found")
 			}
+
 			allowedField, ok := properties["allowed"].(map[string]any)
 			if !ok {
 				t.Fatal("network.allowed schema not found")
@@ -352,6 +353,17 @@ func TestMCPNetworkSchemaDeprecation(t *testing.T) {
 			if !ok || !deprecatedAllowed {
 				t.Fatalf("network.allowed should be marked deprecated; got: %v", allowedField["deprecated"])
 			}
+
+			proxyArgsField, ok := properties["proxy-args"].(map[string]any)
+			if !ok {
+				t.Fatal("network.proxy-args schema not found")
+			}
+			if deprecatedValue, hasDeprecated := proxyArgsField["deprecated"]; hasDeprecated {
+				deprecatedBool, ok := deprecatedValue.(bool)
+				if !ok || deprecatedBool {
+					t.Fatalf("network.proxy-args should not be deprecated; got: %v", deprecatedValue)
+				}
+			}
 		})
 	}
 }

From b5874abc2115f420f7f027fdee0341ed4025e983 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 19 May 2026 23:50:32 +0000
Subject: [PATCH 10/15] Plan parser support removal for MCP network

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/workflows/mcp-inspector.lock.yml       | 2 +-
 .github/workflows/smoke-otel-backends.lock.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml
index 7609d0cd14c..34c3975531d 100644
--- a/.github/workflows/mcp-inspector.lock.yml
+++ b/.github/workflows/mcp-inspector.lock.yml
@@ -1000,7 +1000,7 @@ jobs:
                 "url": "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=core",
                 "headers": {
                   "DD_API_KEY": "\${DD_API_KEY}",
-                  "DD_APPLICATION_KEY": "\${DD_APPLICATION_KEY}",
+                  "DD_APPLICATION_KEY": "\${DD_APP_KEY}",
                   "DD_SITE": "\${DD_SITE}"
                 },
                 "tools": [
diff --git a/.github/workflows/smoke-otel-backends.lock.yml b/.github/workflows/smoke-otel-backends.lock.yml
index a581ff20194..c5f41ee2366 100644
--- a/.github/workflows/smoke-otel-backends.lock.yml
+++ b/.github/workflows/smoke-otel-backends.lock.yml
@@ -773,7 +773,7 @@ jobs:
                 "url": "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=core",
                 "headers": {
                   "DD_API_KEY": "\${DD_API_KEY}",
-                  "DD_APPLICATION_KEY": "\${DD_APP_KEY}",
+                  "DD_APPLICATION_KEY": "\${DD_APPLICATION_KEY}",
                   "DD_SITE": "\${DD_SITE}"
                 },
                 "tools": [

From d0ad03453120e056e08b43abcc083eff3402ab21 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 19 May 2026 23:54:10 +0000
Subject: [PATCH 11/15] Remove per-server MCP network parsing and restore
 deprecated schema semantics

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 pkg/parser/mcp.go                            |  16 ---
 pkg/parser/mcp_test.go                       |  12 +--
 pkg/parser/schema_test.go                    | 104 -------------------
 pkg/parser/schemas/main_workflow_schema.json |  10 +-
 pkg/parser/schemas/mcp_config_schema.json    |   6 +-
 5 files changed, 12 insertions(+), 136 deletions(-)

diff --git a/pkg/parser/mcp.go b/pkg/parser/mcp.go
index b3c8729e108..c9f616d04d0 100644
--- a/pkg/parser/mcp.go
+++ b/pkg/parser/mcp.go
@@ -621,22 +621,6 @@ func ParseMCPConfig(toolName string, mcpSection any, toolConfig map[string]any)
 			}
 		}
 
-		// Extract network configuration for stdio (container-based tools)
-		if network, hasNetwork := mcpConfig["network"]; hasNetwork {
-			if networkMap, ok := network.(map[string]any); ok {
-				// Extract proxy arguments from network config
-				if proxyArgs, hasProxyArgs := networkMap["proxy-args"]; hasProxyArgs {
-					if proxyArgsSlice, ok := proxyArgs.([]any); ok {
-						for _, arg := range proxyArgsSlice {
-							if argStr, ok := arg.(string); ok {
-								config.ProxyArgs = append(config.ProxyArgs, argStr)
-							}
-						}
-					}
-				}
-			}
-		}
-
 	case "http":
 		if url, hasURL := mcpConfig["url"]; hasURL {
 			if urlStr, ok := url.(string); ok {
diff --git a/pkg/parser/mcp_test.go b/pkg/parser/mcp_test.go
index dcd363a10e6..af0d9a10b1d 100644
--- a/pkg/parser/mcp_test.go
+++ b/pkg/parser/mcp_test.go
@@ -645,10 +645,9 @@ func TestParseMCPConfig(t *testing.T) {
 				Allowed: nil,
 			},
 		},
-
 		{
-			name:     "Stdio with network proxy-args (new format)",
-			toolName: "network-proxy-server",
+			name:     "Stdio with deprecated network config ignored",
+			toolName: "network-ignored-server",
 			mcpSection: map[string]any{
 				"type":    "stdio",
 				"command": "docker",
@@ -662,15 +661,12 @@ func TestParseMCPConfig(t *testing.T) {
 			expected: RegistryMCPServerConfig{BaseMCPServerConfig: types.BaseMCPServerConfig{Type: "stdio",
 				Command: "docker",
 				Args:    []string{"run", "myserver"},
-
 				Env:     map[string]string{},
-				Headers: map[string]string{}}, Name: "network-proxy-server",
-
-				ProxyArgs: []string{"--network-proxy-arg1", "--network-proxy-arg2"},
-
+				Headers: map[string]string{}}, Name: "network-ignored-server",
 				Allowed: []string{},
 			},
 		},
+
 		{
 			name:     "Local type (alias for stdio)",
 			toolName: "local-server",
diff --git a/pkg/parser/schema_test.go b/pkg/parser/schema_test.go
index f179f987540..b227cffaf43 100644
--- a/pkg/parser/schema_test.go
+++ b/pkg/parser/schema_test.go
@@ -264,110 +264,6 @@ func TestValidateMCPConfigWithSchema(t *testing.T) {
 	}
 }
 
-func TestMCPNetworkSchemaAllowedDeprecationOnly(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name          string
-		rawSchema     string
-		networkGetter func(map[string]any) map[string]any
-	}{
-		{
-			name:      "main workflow schema stdio_mcp_tool.network",
-			rawSchema: mainWorkflowSchema,
-			networkGetter: func(schema map[string]any) map[string]any {
-				defs, ok := schema["$defs"].(map[string]any)
-				if !ok {
-					return nil
-				}
-				stdioTool, ok := defs["stdio_mcp_tool"].(map[string]any)
-				if !ok {
-					return nil
-				}
-				props, ok := stdioTool["properties"].(map[string]any)
-				if !ok {
-					return nil
-				}
-				network, ok := props["network"].(map[string]any)
-				if !ok {
-					return nil
-				}
-				return network
-			},
-		},
-		{
-			name:      "mcp config schema network",
-			rawSchema: mcpConfigSchema,
-			networkGetter: func(schema map[string]any) map[string]any {
-				props, ok := schema["properties"].(map[string]any)
-				if !ok {
-					return nil
-				}
-				network, ok := props["network"].(map[string]any)
-				if !ok {
-					return nil
-				}
-				return network
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var schema map[string]any
-			if err := json.Unmarshal([]byte(tt.rawSchema), &schema); err != nil {
-				t.Fatalf("failed to parse schema json: %v", err)
-			}
-
-			network := tt.networkGetter(schema)
-			if network == nil {
-				t.Fatal("network schema not found")
-			}
-
-			if deprecatedValue, hasDeprecated := network["deprecated"]; hasDeprecated {
-				t.Fatalf("network.deprecated should be absent from schema, got: %v", deprecatedValue)
-			}
-
-			description, ok := network["description"].(string)
-			if !ok {
-				t.Fatal("network description not found")
-			}
-			if !strings.Contains(description, "proxy-args") {
-				t.Fatalf("network description should mention proxy-args support, got: %q", description)
-			}
-			descriptionLower := strings.ToLower(description)
-			if !strings.Contains(descriptionLower, "allowed") || !strings.Contains(descriptionLower, "ignored") {
-				t.Fatalf("network description should mention that 'allowed' is ignored, got: %q", description)
-			}
-
-			properties, ok := network["properties"].(map[string]any)
-			if !ok {
-				t.Fatal("network properties not found")
-			}
-
-			allowedField, ok := properties["allowed"].(map[string]any)
-			if !ok {
-				t.Fatal("network.allowed schema not found")
-			}
-			deprecatedAllowed, ok := allowedField["deprecated"].(bool)
-			if !ok || !deprecatedAllowed {
-				t.Fatalf("network.allowed should be marked deprecated; got: %v", allowedField["deprecated"])
-			}
-
-			proxyArgsField, ok := properties["proxy-args"].(map[string]any)
-			if !ok {
-				t.Fatal("network.proxy-args schema not found")
-			}
-			if deprecatedValue, hasDeprecated := proxyArgsField["deprecated"]; hasDeprecated {
-				deprecatedBool, ok := deprecatedValue.(bool)
-				if !ok || deprecatedBool {
-					t.Fatalf("network.proxy-args should not be deprecated; got: %v", deprecatedValue)
-				}
-			}
-		})
-	}
-}
-
 func TestValidateMainWorkflowFrontmatterWithSchemaAndLocation_WorkflowDispatchNumberInputType(t *testing.T) {
 	t.Parallel()
 
diff --git a/pkg/parser/schemas/main_workflow_schema.json b/pkg/parser/schemas/main_workflow_schema.json
index 35c44537230..76cfd3e168d 100644
--- a/pkg/parser/schemas/main_workflow_schema.json
+++ b/pkg/parser/schemas/main_workflow_schema.json
@@ -10725,11 +10725,11 @@
         },
         "network": {
           "type": "object",
-          "$comment": "Per-server network settings for stdio MCP tools. Use 'network.proxy-args' for per-server proxy arguments; 'network.allowed' is deprecated and ignored.",
+          "deprecated": true,
+          "$comment": "DEPRECATED: Per-server network configuration is no longer supported. Use top-level workflow 'network:' configuration instead.",
           "properties": {
             "allowed": {
               "type": "array",
-              "deprecated": true,
               "items": {
                 "type": "string",
                 "pattern": "^[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*$",
@@ -10737,7 +10737,7 @@
               },
               "minItems": 1,
               "uniqueItems": true,
-              "description": "DEPRECATED: Per-server allowed domains are ignored. Use top-level workflow 'network.allowed' instead.",
+              "description": "List of allowed domain names for network access",
               "maxItems": 100
             },
             "proxy-args": {
@@ -10749,7 +10749,7 @@
             }
           },
           "additionalProperties": false,
-          "description": "Per-server network configuration for stdio MCP tools. Supports 'proxy-args' for container proxy arguments. The 'allowed' field is deprecated and ignored."
+          "description": "DEPRECATED: Per-server network configuration is no longer supported. Use top-level workflow 'network:' configuration instead. This field is ignored and will be removed in a future version."
         },
         "allowed": {
           "type": "array",
@@ -10768,7 +10768,7 @@
         }
       },
       "additionalProperties": false,
-      "$comment": "Validation constraints: (1) Mutual exclusion: 'command' and 'container' cannot both be specified. (2) Requirement: Either 'command' or 'container' must be provided (via 'anyOf'). (3) Type constraint: When 'type' is 'stdio' or 'local', either 'command' or 'container' is required. Note: In per-server 'network', only 'proxy-args' is supported; 'network.allowed' is deprecated and ignored.",
+      "$comment": "Validation constraints: (1) Mutual exclusion: 'command' and 'container' cannot both be specified. (2) Requirement: Either 'command' or 'container' must be provided (via 'anyOf'). (3) Type constraint: When 'type' is 'stdio' or 'local', either 'command' or 'container' is required. Note: Per-server 'network' field is deprecated and ignored.",
       "anyOf": [
         {
           "required": ["type"]
diff --git a/pkg/parser/schemas/mcp_config_schema.json b/pkg/parser/schemas/mcp_config_schema.json
index d5128372baf..3aea970ec40 100644
--- a/pkg/parser/schemas/mcp_config_schema.json
+++ b/pkg/parser/schemas/mcp_config_schema.json
@@ -149,10 +149,10 @@
     },
     "network": {
       "type": "object",
+      "deprecated": true,
       "properties": {
         "allowed": {
           "type": "array",
-          "deprecated": true,
           "items": {
             "type": "string",
             "pattern": "^[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*$",
@@ -160,7 +160,7 @@
           },
           "minItems": 1,
           "uniqueItems": true,
-          "description": "DEPRECATED: Per-server allowed domains are ignored. Use top-level workflow 'network.allowed' instead.",
+          "description": "List of allowed domain names for network access",
           "examples": [
             ["github.com", "api.github.com"],
             ["example.com", "api.example.com", "cdn.example.com"]
@@ -179,7 +179,7 @@
         }
       },
       "additionalProperties": false,
-      "description": "Per-server network configuration for stdio MCP tools. Supports 'proxy-args' for container proxy arguments. The 'allowed' field is deprecated and ignored.",
+      "description": "DEPRECATED: Per-server network configuration is no longer supported. Use top-level workflow 'network:' configuration instead. This field is ignored and will be removed in a future version.",
       "examples": [
         {
           "allowed": ["github.com", "api.github.com"]

From ee30dd5dc48f67cef3667a533e329547a9f3c8b2 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 20 May 2026 00:12:11 +0000
Subject: [PATCH 12/15] Apply remaining changes

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/workflows/mcp-inspector.lock.yml       | 2 +-
 .github/workflows/smoke-otel-backends.lock.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml
index 34c3975531d..7609d0cd14c 100644
--- a/.github/workflows/mcp-inspector.lock.yml
+++ b/.github/workflows/mcp-inspector.lock.yml
@@ -1000,7 +1000,7 @@ jobs:
                 "url": "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=core",
                 "headers": {
                   "DD_API_KEY": "\${DD_API_KEY}",
-                  "DD_APPLICATION_KEY": "\${DD_APP_KEY}",
+                  "DD_APPLICATION_KEY": "\${DD_APPLICATION_KEY}",
                   "DD_SITE": "\${DD_SITE}"
                 },
                 "tools": [
diff --git a/.github/workflows/smoke-otel-backends.lock.yml b/.github/workflows/smoke-otel-backends.lock.yml
index c5f41ee2366..a581ff20194 100644
--- a/.github/workflows/smoke-otel-backends.lock.yml
+++ b/.github/workflows/smoke-otel-backends.lock.yml
@@ -773,7 +773,7 @@ jobs:
                 "url": "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=core",
                 "headers": {
                   "DD_API_KEY": "\${DD_API_KEY}",
-                  "DD_APPLICATION_KEY": "\${DD_APPLICATION_KEY}",
+                  "DD_APPLICATION_KEY": "\${DD_APP_KEY}",
                   "DD_SITE": "\${DD_SITE}"
                 },
                 "tools": [

From 8af5d9617ddf9da9df88719ccc3b8407d5f49f5e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 20 May 2026 00:52:14 +0000
Subject: [PATCH 13/15] Plan removing per-server mcp-servers network field

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/workflows/smoke-otel-backends.lock.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/smoke-otel-backends.lock.yml b/.github/workflows/smoke-otel-backends.lock.yml
index a581ff20194..c5f41ee2366 100644
--- a/.github/workflows/smoke-otel-backends.lock.yml
+++ b/.github/workflows/smoke-otel-backends.lock.yml
@@ -773,7 +773,7 @@ jobs:
                 "url": "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=core",
                 "headers": {
                   "DD_API_KEY": "\${DD_API_KEY}",
-                  "DD_APPLICATION_KEY": "\${DD_APP_KEY}",
+                  "DD_APPLICATION_KEY": "\${DD_APPLICATION_KEY}",
                   "DD_SITE": "\${DD_SITE}"
                 },
                 "tools": [

From 9b97bd13074b43f3a8047d5f62722dbf850499a1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 20 May 2026 00:59:38 +0000
Subject: [PATCH 14/15] Remove per-server mcp-servers network field from schema
 validation

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 pkg/parser/mcp_test.go                       | 22 ----------
 pkg/parser/schema_test.go                    | 12 ++++++
 pkg/parser/schemas/main_workflow_schema.json | 30 +------------
 pkg/parser/schemas/mcp_config_schema.json    | 45 +-------------------
 4 files changed, 14 insertions(+), 95 deletions(-)

diff --git a/pkg/parser/mcp_test.go b/pkg/parser/mcp_test.go
index af0d9a10b1d..ef67eb71fcf 100644
--- a/pkg/parser/mcp_test.go
+++ b/pkg/parser/mcp_test.go
@@ -645,28 +645,6 @@ func TestParseMCPConfig(t *testing.T) {
 				Allowed: nil,
 			},
 		},
-		{
-			name:     "Stdio with deprecated network config ignored",
-			toolName: "network-ignored-server",
-			mcpSection: map[string]any{
-				"type":    "stdio",
-				"command": "docker",
-				"args":    []any{"run", "myserver"},
-				"network": map[string]any{
-					"allowed":    []any{"example.com", "api.example.com"},
-					"proxy-args": []any{"--network-proxy-arg1", "--network-proxy-arg2"},
-				},
-			},
-			toolConfig: map[string]any{},
-			expected: RegistryMCPServerConfig{BaseMCPServerConfig: types.BaseMCPServerConfig{Type: "stdio",
-				Command: "docker",
-				Args:    []string{"run", "myserver"},
-				Env:     map[string]string{},
-				Headers: map[string]string{}}, Name: "network-ignored-server",
-				Allowed: []string{},
-			},
-		},
-
 		{
 			name:     "Local type (alias for stdio)",
 			toolName: "local-server",
diff --git a/pkg/parser/schema_test.go b/pkg/parser/schema_test.go
index b227cffaf43..617fc123589 100644
--- a/pkg/parser/schema_test.go
+++ b/pkg/parser/schema_test.go
@@ -231,6 +231,18 @@ func TestValidateMCPConfigWithSchema(t *testing.T) {
 			wantErr:     true,
 			errContains: "jsonschema validation failed",
 		},
+		{
+			name: "per-server network rejected by schema",
+			mcpConfig: map[string]any{
+				"type":    "stdio",
+				"command": "node",
+				"network": map[string]any{
+					"proxy-args": []any{"--proxy-test"},
+				},
+			},
+			wantErr:     true,
+			errContains: "jsonschema validation failed",
+		},
 		{
 			name: "valid local type (alias for stdio)",
 			mcpConfig: map[string]any{
diff --git a/pkg/parser/schemas/main_workflow_schema.json b/pkg/parser/schemas/main_workflow_schema.json
index 76cfd3e168d..94d320014ce 100644
--- a/pkg/parser/schemas/main_workflow_schema.json
+++ b/pkg/parser/schemas/main_workflow_schema.json
@@ -10723,34 +10723,6 @@
           "additionalProperties": false,
           "description": "Environment variables for MCP server"
         },
-        "network": {
-          "type": "object",
-          "deprecated": true,
-          "$comment": "DEPRECATED: Per-server network configuration is no longer supported. Use top-level workflow 'network:' configuration instead.",
-          "properties": {
-            "allowed": {
-              "type": "array",
-              "items": {
-                "type": "string",
-                "pattern": "^[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*$",
-                "description": "Allowed domain name"
-              },
-              "minItems": 1,
-              "uniqueItems": true,
-              "description": "List of allowed domain names for network access",
-              "maxItems": 100
-            },
-            "proxy-args": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "description": "Custom proxy arguments for container-based MCP servers"
-            }
-          },
-          "additionalProperties": false,
-          "description": "DEPRECATED: Per-server network configuration is no longer supported. Use top-level workflow 'network:' configuration instead. This field is ignored and will be removed in a future version."
-        },
         "allowed": {
           "type": "array",
           "description": "List of allowed tool names for this MCP server",
@@ -10768,7 +10740,7 @@
         }
       },
       "additionalProperties": false,
-      "$comment": "Validation constraints: (1) Mutual exclusion: 'command' and 'container' cannot both be specified. (2) Requirement: Either 'command' or 'container' must be provided (via 'anyOf'). (3) Type constraint: When 'type' is 'stdio' or 'local', either 'command' or 'container' is required. Note: Per-server 'network' field is deprecated and ignored.",
+      "$comment": "Validation constraints: (1) Mutual exclusion: 'command' and 'container' cannot both be specified. (2) Requirement: Either 'command' or 'container' must be provided (via 'anyOf'). (3) Type constraint: When 'type' is 'stdio' or 'local', either 'command' or 'container' is required.",
       "anyOf": [
         {
           "required": ["type"]
diff --git a/pkg/parser/schemas/mcp_config_schema.json b/pkg/parser/schemas/mcp_config_schema.json
index 3aea970ec40..687032ec267 100644
--- a/pkg/parser/schemas/mcp_config_schema.json
+++ b/pkg/parser/schemas/mcp_config_schema.json
@@ -147,49 +147,6 @@
         }
       ]
     },
-    "network": {
-      "type": "object",
-      "deprecated": true,
-      "properties": {
-        "allowed": {
-          "type": "array",
-          "items": {
-            "type": "string",
-            "pattern": "^[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*$",
-            "description": "Allowed domain name"
-          },
-          "minItems": 1,
-          "uniqueItems": true,
-          "description": "List of allowed domain names for network access",
-          "examples": [
-            ["github.com", "api.github.com"],
-            ["example.com", "api.example.com", "cdn.example.com"]
-          ]
-        },
-        "proxy-args": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          },
-          "description": "Custom proxy arguments for container-based MCP servers",
-          "examples": [
-            ["--proxy", "http://proxy.example.com:8080"],
-            ["--proxy-auth", "user:pass"]
-          ]
-        }
-      },
-      "additionalProperties": false,
-      "description": "DEPRECATED: Per-server network configuration is no longer supported. Use top-level workflow 'network:' configuration instead. This field is ignored and will be removed in a future version.",
-      "examples": [
-        {
-          "allowed": ["github.com", "api.github.com"]
-        },
-        {
-          "allowed": ["example.com"],
-          "proxy-args": ["--proxy", "http://proxy.example.com:8080"]
-        }
-      ]
-    },
     "allowed": {
       "type": "array",
       "items": {
@@ -218,7 +175,7 @@
       "then": {
         "required": ["url"],
         "not": {
-          "anyOf": [{ "required": ["command"] }, { "required": ["container"] }, { "required": ["network"] }]
+          "anyOf": [{ "required": ["command"] }, { "required": ["container"] }]
         }
       }
     },

From a4571ec797bdd3bbd64ae995be7fe97ccdc0be7f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 20 May 2026 01:04:56 +0000
Subject: [PATCH 15/15] Drop unrelated mcp-inspector lock change from branch

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/workflows/mcp-inspector.lock.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml
index 7609d0cd14c..34c3975531d 100644
--- a/.github/workflows/mcp-inspector.lock.yml
+++ b/.github/workflows/mcp-inspector.lock.yml
@@ -1000,7 +1000,7 @@ jobs:
                 "url": "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=core",
                 "headers": {
                   "DD_API_KEY": "\${DD_API_KEY}",
-                  "DD_APPLICATION_KEY": "\${DD_APPLICATION_KEY}",
+                  "DD_APPLICATION_KEY": "\${DD_APP_KEY}",
                   "DD_SITE": "\${DD_SITE}"
                 },
                 "tools": [