devin: swe-2 rejects any tool declaration upstream (permission_denied: MCP configuration issue) while swe-1-7 accepts the same payload

Environment

• CLIProxyAPI: HEAD-7bbfeaf (7.3.3+), macOS arm64, brew build
• Devin auth: OAuth login via -devin-login (session token, standard account)

Summary

Requests to devin/swe-2 that include ANY tool declaration fail deterministically upstream with permission_denied / "Unable to process request due to an MCP configuration issue". The exact same payload with model=devin/swe-1-7 succeeds, including real function calls.

Repro (via local proxy)

1. Works — swe-2, no tools: POST /v1/responses {"model":"devin/swe-2","input":"hi","max_output_tokens":2000} → 200

2. Fails — swe-2, one minimal function tool: POST /v1/responses {"model":"devin/swe-2","input":"weather in seoul? use the tool","tools":[{"type":"function","name":"get_weather","description":"Get weather","parameters":{"type":"object","properties":{"city":{"type":"string"}},"required":["city"]}}]} → 503 devin upstream error (permission_denied): Unable to process request due to an MCP configuration issue. (trace ID: 2c5cdda10de14e5edda1b671f1040d30)

3. Works — same payload with swe-1-7: → 200 with function_call get_weather({"city":"Seoul"})

Additional observations:

• Tool name style does not matter (get_weather, mcp__local__get_weather, shell all fail on swe-2).
• Reproduces on both /v1/responses and /v1/chat/completions.
• Separately, Devin upstream occasionally returns invalid_argument: an internal error occurred (e.g. trace ID e246907cc952746d2ad0bb5f7046d0a6) that is transient — retrying the identical payload succeeds. Full Codex-CLI-sized payloads (~40 tools incl. namespace/custom types) also hit intermittent stream drops (stream disconnected before completion) on swe-1-7.

Guess: swe-2 appears to gate externally-declared tools (MCP-style) on the account/backend side, or requires a different tool declaration encoding than field-10 repeated tools.

Happy to test any patch or capture more traces.