Fix recurring 60s timeout in logs MCP tool degrading audit datasets

.github/workflows/safe-output-health.md

@@ -15,7 +15,10 @@ sandbox:
   agent:
     sudo: false
 
-engine: claude
+engine:
+  id: claude
+  mcp:
+    tool-timeout: 10m
 max-ai-credits: 1500
 tools:
   cli-proxy: true

docs/src/content/docs/reference/gh-aw-as-mcp-server.md

@@ -142,7 +142,7 @@ Download and analyze workflow logs with timeout handling and size guardrails.
 - `engine`, `firewall`, `no_firewall`, `branch` (optional): Run filters
 - `after_run_id`, `before_run_id` (optional): Pagination by run ID
 - `artifacts` (array of strings, optional): Artifact sets to download. Valid values: `all`, `activation`, `agent`, `detection`, `experiment`, `firewall`, `github-api`, `mcp`, `usage`. Defaults to `usage`.
-- `timeout` (optional): Max seconds to download (default: 50)
+- `timeout` (optional): Max minutes to download (default: auto-scales with count in the MCP server, rounded up in 40-run increments; e.g. 1 minute up to 40 runs, 2 minutes for 41-80, 3 minutes for 81-120). For large date-range fetches set this explicitly (e.g. `10`) and also configure `engine.mcp.tool-timeout: 10m` in the workflow frontmatter so the MCP gateway allows enough time.
 - `max_tokens` (optional): Output token guardrail (default: 12000)
 - `jq` (optional): Apply jq filter to JSON output
 

pkg/cli/mcp_tools_privileged.go

@@ -208,7 +208,7 @@ from where the previous request stopped due to timeout.`,
 		cmdArgs = appendRepoFlagFromEnv(cmdArgs)
 
 		// Scale the implicit MCP timeout with the requested fetch window so
-		// larger fleet-wide requests do not hit the 60s server deadline by default.
+		// larger fleet-wide requests do not hit the default per-tool timeout.
 		timeoutValue := effectiveMCPLogsToolTimeoutMinutes(args.Timeout, effectiveCount)
 		cmdArgs = append(cmdArgs, "--timeout", strconv.Itoa(timeoutValue))
 
@@ -262,6 +262,7 @@ from where the previous request stopped due to timeout.`,
 			if mainMsg == "" {
 				mainMsg = err.Error()
 			}
+
 			return nil, nil, newMCPError(jsonrpc.CodeInternalError, "failed to download workflow logs: "+mainMsg, errorData)
 		}