* Enrich issue_read get with hierarchy relationship signals
The default issue_read `get` payload surfaced no hierarchy data, forcing
agents to drop to raw REST (parent_issue_url) or scan sibling sub_issues
to discover relationships. Enrich `get` with a layered, zero-extra-round-trip
relationship signal derived from a single combined GraphQL query:
- has_parent / has_children: cheap, always-emitted routing booleans
(addresses Sam Morrow's #2726 review note).
- parent: compact ref (number/title/state/url/repository) mirroring the
existing get_parent payload keys; omitted when there is no parent.
- sub_issues_summary: native subIssuesSummary counts (total/completed/
percent_completed); omitted when there are no sub-issues.
The single-issue field-values GraphQL call in GetIssue is replaced by one
combined query (fetchIssueReadEnrichment) returning field values + parent +
subIssuesSummary, so `get` adds no round-trips. Enrichment is best-effort:
a query failure still returns the base issue and never fails `get`. Parent
titles are sanitized (parent may be cross-repo) and redacted under lockdown
mode unless the parent content can be verified as safe; numeric/structural
fields and counts stay intact. get_parent / sub_issue_write behavior is
unchanged; tool descriptions clarify hierarchy is read here but written via
sub_issue_write (no writable parent field).
Refs github/planning-tracking#3306
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Tighten hierarchy tool wording
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Omit unverified parent under lockdown instead of redacting title
Align issue_read get parent enrichment with the codebase's existing
lockdown patterns: rather than introducing a third, redaction-with-sentinel
behavior, omit the whole parent reference when its (possibly cross-repo)
content cannot be verified safe. This mirrors how unsafe comments, sub-issues,
and PR reviews are filtered out. has_parent stays true so an agent can still
route to get_parent.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Restore explicit issue read query matcher
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Omit hierarchy flags when enrichment fails
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address hierarchy review nits
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Roberto Nacu <kerobbi@github.com>
* chore(deps): upgrade go-sdk to v1.7.0-pre.1 (new MCP spec)
Bumps github.com/modelcontextprotocol/go-sdk v1.6.1 -> v1.7.0-pre.1, the
pre-release that implements the new stateless MCP spec (SEP-2575 server/discover,
SEP-2567 sessionless, MRTR per SEP-2322).
The only source-visible change is tool annotation serialization: the new SDK
drops `omitempty` on ToolAnnotations.ReadOnlyHint and IdempotentHint, so false
values are now emitted explicitly. Regenerated the 113 affected toolsnaps to
match. No behavioural changes; build, vet, test and lint all pass.
Refs: github/copilot-mcp-core#1709
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* chore: regenerate license files
Auto-generated by license-check workflow
* ci(mcp-diff): pin to cross-spec-aware mcp-server-diff (3c2d5ea)
Pins both the stdio and streamable-http MCP Server Diff jobs to the 3.0
branch of SamMorrowDrums/mcp-server-diff (commit 3c2d5ea), which normalizes
cross-spec-version churn: _meta protocol plumbing, CacheableResult cache
hints, the initialize envelope, and tool-annotation default hints. Without it
the go-sdk v1.6.1 -> v1.7.0-pre.1 bump would surface ~113 spurious
idempotentHint/readOnlyHint:false diffs from the SDK dropping omitempty.
Temporary commit pin; move to the v3.0.0 tag once it ships.
Refs: github/copilot-mcp-core#1709
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* ci(mcp-diff): bump to a2ba618 (stateless server/discover probe)
a2ba618 adds the SEP-2575 server/discover stateless probe path, so each
server is probed at its own newest supported spec (base v1.6.1 via
initialize/2025-11-25, this branch via server/discover/2026-07-28) rather
than negotiating both down to the legacy handshake. Produces an honest,
signal-only cross-spec diff. Still a temporary commit pin; moves to v3.0.0
once tagged.
Refs: github/copilot-mcp-core#1709
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* ci(mcp-diff): use full commit SHA for action pin
Actions rejects shortened SHAs ('not supported'); use the full
a2ba618c42293fb36e67be88e59c60d5608a302a so the action resolves.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* ci(mcp-diff): track 3.0 HEAD (8fc26d8, becomes v3.0.0)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* feat(inventory): project owner/repo to Mcp-Param-* headers (SEP-2243)
Annotates owner/repo tool params with x-mcp-header so the SDK projects them
to Mcp-Param-owner/Mcp-Param-repo request headers. A remote proxy can route
and filter on owner/repo from headers instead of re-parsing the JSON-RPC body
(headers are SDK-validated against the body). No-op for tools without these
params; old-protocol traffic unaffected.
Refs: github/copilot-mcp-core#1709, #1828
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(inventory): preserve instructions in ForMCPRequest incl. server/discover
ForMCPRequest dropped the generated instructions when narrowing the per-request
inventory, so HTTP server/discover (and initialize) returned empty instructions
even though the full inventory had them. Preserve instructions on the copy and
treat server/discover like initialize. Fixes discover<->initialize parity flagged
on go-sdk#1034 (root cause was here, not the SDK).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* ci(mcp-diff): pin to mcp-server-diff v3.0.0
Release is out; move both jobs from the 3.0-branch SHA to v3.0.0
(3521651, full SHA since Actions rejects short SHAs).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* test(github): enforce owner/repo header projection across all tools
Export HeaderParams + AnnotateHeaderParams and add a coverage test over the
full all-toolsets inventory asserting every owner/repo param projects to its
Mcp-Param-* header. Guards the remote proxy's per-request header read so a new
tool can never silently ship without it (would fall back to body re-parsing).
Adding a future routing param is one entry in inventory.HeaderParams.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(inventory): clone schema before header annotation to avoid shared-map race
AnnotateHeaderParams mutated the *jsonschema.Schema (and per-property Extra
maps) shared with the original tool definition via the caller's shallow copy.
Under per-request registration (remote server), concurrent requests could race
on — and fatally panic from — the same Extra map. Now clone only what we touch
(schema value, Properties map, annotated property schemas + their Extra maps);
the original is never written. Adds a no-mutation test and a 64-goroutine
race regression (go test -race clean).
Addresses Copilot review on #2787.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Sort all JSON object keys alphabetically at every level in toolsnaps by
unmarshaling and remarshaling. This leverages Go's built-in behavior where
json.Marshal automatically sorts map keys alphabetically, ensuring
consistent field ordering and eliminating noop churn in diffs.
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
Bryan Zwicker