fix(scouts): add web_search/web_fetch fallback when MCPs fail (#53)

When Brave/Exa/Tavily MCP servers auth-fail (as happened 2026-04-22 when
all three API keys were unavailable in the cron env), scout agents had
no tool to fall back on and silently degraded — every scout reported
status: complete with 0 repos added and error: null. The entire nightly
fleet produced zero live-verified discoveries.

Kiro ships native web_search and web_fetch built-ins, but the scout
agent configs narrowed their tool whitelist to ["read","write",
"@brave-search","@Tavily","@exa"] only, so those built-ins were
unreachable even when MCP providers broke.

Add web_search/web_fetch to the tool whitelist for both project-watcher
(scout root) and probe-topic (parallel subagent), and update the
steering prompts to instruct the agents to fall back to native web
tools when an MCP provider auth-fails rather than abandoning the topic
or synthesizing from training knowledge.

Prefer MCP providers for structured results and source diversity; native
tools are the always-available safety net.

Author: theagenticguy

src/data/probe-topic.json

@@ -2,8 +2,23 @@
 	"name": "probe-topic",
 	"description": "Intra-scout subagent: deep-dives a single topic from the parent scout's manifest and returns a structured repo-discovery report. Invoked via use_subagent(InvokeSubagents) with one topic per call so topics are explored in parallel isolated contexts.",
 	"model": "claude-haiku-4-5-20251001",
-	"tools": ["read", "write", "@brave-search", "@tavily", "@exa"],
-	"allowedTools": ["read", "@brave-search", "@tavily", "@exa"],
+	"tools": [
+		"read",
+		"write",
+		"web_search",
+		"web_fetch",
+		"@brave-search",
+		"@tavily",
+		"@exa"
+	],
+	"allowedTools": [
+		"read",
+		"web_search",
+		"web_fetch",
+		"@brave-search",
+		"@tavily",
+		"@exa"
+	],
 	"includeMcpJson": true,
 	"prompt": "file://../steering/probe-topic.md"
 }

src/data/probe-topic.md

@@ -18,7 +18,10 @@ for that one topic and return. You never fan out further.
 ## What to do
 
 1. Search across `@brave-search`, `@tavily`, and `@exa` for trending GitHub
-   repositories matching the topic. Deduplicate by `owner/name`.
+   repositories matching the topic. Deduplicate by `owner/name`. If any of
+   those MCP providers returns an auth / rate-limit error, fall back to
+   Kiro's built-in `web_search` and `web_fetch` rather than abandoning the
+   topic.
 2. For each candidate repo, note: star count, last-commit date, primary
    language, and a one-sentence description.
 3. Filter to repos that:

src/data/project-watcher.json

@@ -1,7 +1,15 @@
 {
 	"name": "project-watcher",
 	"description": "Iterative deep research agent for discovering trending GitHub repos matching watched topics and languages. Fans out per-topic deep dives to the probe-topic subagent.",
-	"tools": ["read", "write", "@brave-search", "@tavily", "@exa"],
+	"tools": [
+		"read",
+		"write",
+		"web_search",
+		"web_fetch",
+		"@brave-search",
+		"@tavily",
+		"@exa"
+	],
 	"allowedTools": ["*"],
 	"includeMcpJson": true,
 	"resources": [

src/data/watcher-context.md

@@ -80,6 +80,15 @@ Cast a wide net across all search tools:
 - Search for blog posts announcing new tools and frameworks
 - Search for "awesome list" additions in your topic areas
 
+**Fallback — Kiro native `web_search` / `web_fetch`:**
+If a given MCP search provider returns an authentication or rate-limit
+error, fall back to the built-in `web_search` and `web_fetch` tools rather
+than giving up or synthesizing from training knowledge. Prefer the MCP
+providers for their structured results and source diversity, but do not
+treat them as the only path. A scout run with zero discoveries because all
+three MCPs auth-failed is a preventable failure mode — native search is
+always available.
+
 For each candidate repo found, record:
 - Full repo name (owner/repo)
 - GitHub URL