One envelopecode · message · retry
retry says what to dochange-input · needs-human · retry · no
Every card has a fixand at least one is a button
Errors, explained
An error on this site is an object with three parts, never a code alone. The full taxonomy lives in Reference → Errors; this is what a card looks like.
Reason
build has no plane: field, so it defaults to control. The data plane builds its allow-list from plane !== "control" and 404s everything else — by rule.Tracecli → POST :3718/capabilities/build → DATA_PLANE_SLUGS.has("build") = false ✕
What the agent does with
retrychange-input: fix the request and go again. needs-human: stop and ask you. retry: try again. no: report the resource id.
Two exceptions worth knowing
MCP errors ride HTTP 200 as JSON-RPC errors. A rejected bearer on /mcp is always 401 invalid_token on the wire; the real reason is on the mcp.auth_reject log line.
The full error taxonomy is in Reference → Errors — six error codes, each with a retry strategy and a sample fix.