fix: non-blocking server initialization for faster gateway startup

[jchangx]

Summary

• Move reloadConfiguration to a background goroutine so the transport server starts immediately instead of blocking on all MCP servers responding
• Add a 15s per-server timeout in listCapabilities to prevent one slow/unreachable server from blocking the rest

Problem

When VPN-only servers (e.g. grafana-remote, sigma-remote at *.s.us-east-1.aws.dckr.io) are unreachable, the gateway takes ~60s to start because reloadConfiguration blocks on listCapabilities, which waits for each server's 30s transport timeout. This causes MCP clients (like Claude Code's /mcp reconnect) to time out before the gateway becomes ready.

Approach

Non-blocking init: The transport server (stdio/sse/streaming) now starts immediately. reloadConfiguration runs in a background goroutine. The go-sdk's Server.AddTool is thread-safe and automatically sends notifications/tools/list_changed to connected clients, so tools appear progressively as each server responds.

Per-server timeout: Each server in listCapabilities now gets a 15s context timeout. This prevents one unreachable server from consuming the full transport timeout (30s) and ensures healthy servers aren't delayed waiting for the errgroup to complete.

Risk analysis

Component	Risk	Notes
startStdioServer	None	No dependency on tools being loaded
Server.AddTool thread safety	None	go-sdk uses mutex; fully thread-safe
OAuth provider startup	None	Independent of reloadConfiguration
Profile loading middleware	Low	Runs after client initialize, giving background load time
Health state	Low	Stays unhealthy until load completes (correct behavior)
Initial tools/list response	Low	Clients may see incomplete list briefly; tools/list_changed notification triggers re-fetch
Background reload failure	Low	Logged; tools load on next config update

Test plan

• go build ./pkg/gateway/... compiles cleanly
• go test ./pkg/gateway/... -short passes
• Manual test: start gateway with VPN off, verify stdio server starts in <2s
• Manual test: verify tools appear after background load completes
• Manual test: Claude Code /mcp reconnect works on first try without VPN
• Verify tools/list_changed notification reaches Claude Code and triggers tool re-fetch

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bcd0e0b060

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep initial reload synchronous in dry-run mode

Launching reloadConfiguration in a goroutine here means gateway run --dry-run can return at line 436 before any capability discovery executes, because dry-run exits immediately and the process can terminate before the background goroutine runs. This regresses dry-run from a real configuration/capability validation pass into a best-effort no-op, so broken/unreachable server configs may now appear successful and expected dry-run output (discovered tools / initialization summary) can be missing.

Useful? React with 👍 / 👎.