docs: fix 4 documentation discrepancies from nightly reconciliation

[Copilot]

Fixes all 4 discrepancies identified in the 2026-03-15 nightly documentation reconciliation report.

Changes

🔴 Critical: MCP_GATEWAY_API_KEY authentication clarification

The documentation falsely implied that setting MCP_GATEWAY_API_KEY enables authentication in the awmg binary. The binary never reads this env var directly — it only reads the API key from config ([gateway] api_key in TOML, or "gateway": {"apiKey": "..."} in JSON stdin).

Updated:

• README.md: env vars tables, Authentication configuration section, quick-start example (added gateway.apiKey with variable expansion)
• CONTRIBUTING.md: container run description and required env vars list

Users must now reference the env var in their JSON config:

{
  "gateway": {
    "apiKey": "${MCP_GATEWAY_API_KEY}"
  }
}

🟡 Important: config.toml ARM64 DOCKER_API_VERSION comment

Fixed incorrect comment stating ARM64 uses 1.43. Both architectures fall back to 1.44, consistent with the README and shell scripts (run.sh, run_containerized.sh).

🟡 Important: CONTRIBUTING.md guard directory description

Updated outdated "NoopGuard active" comment to accurately list all three implementations: NoopGuard, WasmGuard, WriteSink.

🔵 Minor: working_directory TOML-only qualifier

Added "TOML format only" qualifier to the working_directory field description in README.md, since StdinServerConfig has no corresponding field.

[Copilot]

Pull request overview

Updates repository documentation/config samples to resolve discrepancies found in the nightly documentation reconciliation, primarily clarifying how API-key authentication is actually configured in awmg.

Changes:

• Clarifies that API key auth is configured via gateway config (gateway.apiKey in JSON stdin / gateway.api_key in TOML), and updates examples/env-var tables accordingly.
• Fixes DOCKER_API_VERSION notes to reflect daemon-version detection with 1.44 fallback.
• Updates CONTRIBUTING guard directory description and adds “TOML-only” qualifier for working_directory.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
config.toml	Updates comment about how DOCKER_API_VERSION is determined/fallback behavior.
README.md	Clarifies API key auth configuration source; updates quick-start and env-var tables; annotates working_directory as TOML-only.
CONTRIBUTING.md	Updates guard directory description and clarifies container env-var requirements / auth configuration.

Comments suppressed due to low confidence (3)

README.md:554

• This line claims MCP_GATEWAY_API_KEY is “not read directly by the binary”, but the awmg CLI can read it when --validate-env is enabled (ValidateExecutionEnvironment checks required env vars). Also, authentication can be enabled by setting gateway.apiKey directly, so referencing ${MCP_GATEWAY_API_KEY} isn’t strictly required. Suggest tightening the wording to “not used for authentication unless referenced in config” and optionally mention the --validate-env behavior.

| `MCP_GATEWAY_API_KEY` | Informational only — not read directly by the binary; must be referenced in your config via `"${MCP_GATEWAY_API_KEY}"` to enable authentication | (disabled) |

README.md:612

• These comments say the config “must reference” MCP_GATEWAY_API_KEY for authentication, but auth can be enabled by setting gateway.apiKey directly in config; referencing the env var is only needed if you want the key sourced from the environment. Consider rewording to avoid implying a hard requirement.

# Note: MCP_GATEWAY_API_KEY is checked by run_containerized.sh as a deployment gate.
# For authentication to be active, your config.json must reference it via variable expansion:
#   "gateway": { "apiKey": "${MCP_GATEWAY_API_KEY}" }

CONTRIBUTING.md:505

• Same issue as above: this implies referencing MCP_GATEWAY_API_KEY via ${…} is required to enable authentication, but setting gateway.apiKey directly in the JSON config also enables auth. Consider rewording to “to configure the API key via env var …”.

- `MCP_GATEWAY_API_KEY` - Checked by `run_containerized.sh` as a deployment gate; must be referenced in your JSON config via `"gateway": {"apiKey": "${MCP_GATEWAY_API_KEY}"}` to enable authentication

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.