If there is any authentication front of kubewall, then AI can't use tools, but fails with 401 error.

Probably kubewall should provide Bearer token (if provided by user), when delivering MCP tools info to AI:
https://platform.openai.com/docs/guides/tools-connectors-mcp#authentication

"most other MCP servers require authentication. The most common scheme is an OAuth access token. Provide this token using the authorization field of the MCP tool"
"To prevent the leakage of sensitive tokens, the Responses API does not store the value you provide in the authorization field. This value will also not be visible in the Response object created. Because of this, you must send the authorization value in every Responses API creation request you make."