401 / WWW-Authenticate — missing or invalid Bearer API Key on tools/call.
Empty tools/list — no published releases on the active profile, or wrong environment.
Capability not granted / quota — fix grants or billing before retrying.
Unknown Mcp-Session-Id — re-run initialize without the old session header.