github-featured/github--github-mcp-server
2
0
Fork 0
Code Issues Pull Requests Deployments Models Agent Notes Packages Projects Releases Wiki Activity
1,099 Commits 286 Branches 79 Tags
main
Commit Graph

112 Commits

Author SHA1 Message Date
Sam Morrow 30600ba335 perf(repos): reduce symlink guard overhead 
Remove persistent repository and push-files guidance in favor of concise runtime recovery content. Resolve refs directly through Git Trees, skip inspection for explicit symlinks and opt-ins, and lock request counts in tests.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-08-19 13:06:59 +02:00
Keshav Malik 596203ef54 Clarify symlink behavior for repository file writes 2026-08-19 13:06:59 +02:00
Sam Morrow 8ec62491c6 Add confirmed repository deletion tool (#3076) 
* feat(repos): add confirmed repository deletion

Add a destructive delete_repository tool that requires an exact owner/repo confirmation through multi-round-trip elicitation. Gate the tool to MCP protocol 2026-07-28 and newer across local and remote transports.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* refactor(inventory): generalize tool availability guards

Gate protocol-restricted tools on required elicitation capabilities and enforce direct calls inside the registered handler so SDK result finalization remains intact.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* feat(http): protect MRTR request state

Seal repository deletion targets for self-hosted HTTP with a stable AES-256-GCM key. Hide only delete_repository when no key is configured and expose an optional sealer interface for remote integrators.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* fix(repos): expire deletion confirmations

Bind sealed repository deletion state to the immutable repository ID and a ten-minute expiry. Re-check identity before deletion so replay cannot affect a recreated repository.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* fix(http): preserve tool and scope restrictions

Apply static allowlists before removing unavailable tools and fail closed on invalid configured tool names. Model independent OAuth requirements as conjunctive groups so repository deletion requires both delete_repo and repo.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* fix(repos): require protected confirmation state

Give stdio a process-local request-state sealer and make deletion fail closed without one. Preserve legacy any-of OAuth behavior globally while documenting and enforcing delete_repository's conjunctive delete_repo and repo requirements.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* fix(oauth): request repository deletion scope

Include delete_repo in the supported OAuth scope set used by stdio login, HTTP protected-resource metadata, and tool filtering.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* fix(oauth): require deletion scope opt-in

Keep delete_repo in protected-resource discovery for step-up authorization while excluding it from the default stdio OAuth grant.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* refactor(oauth): derive scope sets from catalog

Generate protected-resource supported scopes and the lower-risk default OAuth grant from one canonical scope definition list.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* refactor(scopes): own OAuth scope catalog

Move supported and default OAuth scope policy into pkg/scopes so protected-resource metadata and stdio grants derive from the scope domain package.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* fix(scopes): require workflow scope opt-in

Keep workflow and codespace in protected-resource discovery while excluding both from the default OAuth grant alongside delete_repo.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

---------

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8
 2026-08-18 14:50:38 +02:00
Michael Jacholke 1b3f89a90a Add non-default find_duplicate tool gated by duplicate_detection flag (#3020) 
* Add non-default find_duplicate tool gated by duplicate_detection flag

* Trim find_duplicate output to spec fields and relax confidence_threshold bounds

* Attach repo-visibility IFC label to find_duplicate results
 2026-08-07 09:45:49 +01:00
Kelsey Myers f3cb662c25 Make search_issues semantic by default (#2964) 
* Make search_issues semantic by default

* initialize description depending on the host

---------

Co-authored-by: Iulia B <iulia-b@github.com>
Co-authored-by: Iulia Bejan <64602043+iulia-b@users.noreply.github.com>
 2026-08-06 16:51:13 +02:00
Tommaso Moro 456fae9d04 Make fields parameter available by default (#2952) 
* Promote fields parameter beyond Insiders

Keep fields_param as an independently controlled feature flag while removing it from the Insiders expansion.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Make fields parameter available by default

Remove the fields_param feature flag and legacy tool variants so selected read tools always advertise and honor fields.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 5c43cc70-27b5-47b4-bbd1-99d20f42d61b

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5c43cc70-27b5-47b4-bbd1-99d20f42d61b
 2026-07-29 14:06:03 +01:00
Boaz Reicher 9d130049e9 Add opt-in intent-aware Copilot issue assignment tool (#2909) 
* Add opt-in intent-aware Copilot issue assignment tool

Add `assign_copilot_to_issue_with_intent` in a new non-default toolset
`copilot_issue_intents`. The tool uses GraphQL's object-form
`assignees: [AssigneeUpdateInput!]` so intent metadata (rationale,
confidence, is_suggestion) is attached to the Copilot entry only, while
existing assignees are preserved.

- Reuses the existing Copilot actor lookup, target-repository
  resolution, base_ref, custom_instructions, GraphQL-Features header,
  and direct-assignment PR polling behavior.
- `is_suggestion: true` records a pending Copilot assignment intent,
  returns a suggestion-shaped result, and does not launch Copilot or
  poll for a linked PR.
- `rationale` is capped at 280 characters (schema + runtime);
  `confidence` is validated against `LOW`/`MEDIUM`/`HIGH`.
- Toolset is non-default so its inputs do not add schema bloat to the
  default tool surface; available via `copilot_issue_intents`,
  `all`, or explicit tool selection.

Includes unit tests for direct assignment (with existing assignees and
with base_ref/custom_instructions), the suggestion path, invalid
rationale length, invalid confidence, and Copilot-not-available; a
generated toolsnap; regenerated docs; and an e2e test for the
suggestion path.

Refs: github/plan-track-agentic-toolkit#683

* Address review: tighten description, require intent fields

Per review feedback on #2909:

- Trim the tool description to mirror assign_copilot_to_issue and add
  "Prefer this tool over assign_copilot_to_issue when available",
  removing the verbose is_suggestion narrative from the schema.
- Make rationale, confidence, and is_suggestion required inputs (schema
  and runtime). is_suggestion is now always sent explicitly on the
  Copilot AssigneeUpdateInput entry.
- Update unit tests to supply the newly-required fields and cover the
  missing-rationale and missing-confidence rejection paths.
- Regenerate toolsnap and README.

* Address review: dedupe copilot, require is_suggestion, update doc link

Per @RossTarrant review feedback on #2909:

- Reject requests where `is_suggestion` is omitted from the raw args
  before decoding. `mapstructure.WeakDecode` defaults missing bools
  to false, which would silently launch Copilot instead of recording a
  suggestion. Presence-check the raw map so callers make the choice
  explicit.
- Skip the copilot-swe-agent actor when copying existing assignees so
  we don't send its actorId twice (once without metadata and once with
  intent metadata) when Copilot is already assigned.
- Update the stale about-assigning-tasks-to-copilot reference to the
  redirect target (about-cloud-agent). Applied to the const message,
  both tool descriptions, and the e2e/unit-test literals that assert
  on that message.

New unit tests cover the missing-is_suggestion rejection and the
copilot-dedup behavior. Regenerated toolsnaps.
 2026-07-21 02:27:09 -07:00
Tommaso Moro 439ec711fa Add fields param to six more list/search tools (#2810) 
* Add fields param to six more list/search tools

Extend the optional `fields` response-filtering parameter (gated behind the
`fields_param` feature flag, with adoption/savings telemetry) to six more read
tools, following the dual-variant pattern already used by search_code and
get_file_contents:

- list_issues, list_pull_requests, list_commits, list_releases
- search_issues, search_pull_requests

For each tool, `X` is the flag-enabled variant that advertises `fields` and
filters each result item to the requested subset, while `LegacyX` exposes the
original schema and never filters, acting as a kill switch when the flag is off.
Exactly one variant survives inventory filtering for any flag state via mutually
exclusive FeatureFlagEnable / FeatureFlagDisable annotations. Wrapped responses
(list_issues, search_issues, search_pull_requests) preserve their count /
pagination envelope and only filter the item list; bare-array responses keep
their array shape.

Filtering reuses the shared filterEachField helper. A new fieldsSchemaProperty
helper builds the `fields` schema (search_code and get_file_contents now use it
too), and a shared recordFieldsUsageFor helper centralizes the telemetry
full-size computation. Each field enum lists only the JSON fields the specific
tool actually emits: list_commits omits stats/files (requested without per-file
detail) and list_issues lists only the fields its GraphQL fragment populates.

Adds per-tool field-filtering, telemetry, and Legacy definition tests, extends
the mutual-exclusivity gating test to all eight gated tools, and regenerates the
`_ff_fields_param` toolsnaps and feature-flag docs.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Remove duplicate tool doc comments

Address review: drop the leftover one-line doc comment above each dual-variant
tool constructor (list_issues, list_pull_requests, list_commits, list_releases,
search_issues, search_pull_requests); the detailed variant comment remains.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-07-10 13:09:34 +01:00
Tommaso Moro 3b8ff504c0 Add fields param to search_code and get_file_contents (#2775) 
* Add fields param to search_code and get_file_contents

Add an optional `fields` array parameter to the `search_code` and
`get_file_contents` tools so callers can request only the fields they
need, reducing tool response size and context usage.

- search_code: filters each result item to the selected fields while
  preserving the total_count / incomplete_results wrapper.
- get_file_contents: filters each directory entry when listing a
  directory; ignored for single-file responses.

Adds shared filterFields / filterEachField helpers and per-tool field
enums, plus unit tests and regenerated toolsnaps and docs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Gate fields param behind fields_param flag and add usage telemetry

Register search_code and get_file_contents as two mutually exclusive
variants gated by the new `fields_param` feature flag, following the
existing dual-variant flag pattern:

- The flag-enabled variant advertises the optional `fields` parameter and
  filters each result to the requested subset. It owns the
  `<tool>_ff_fields_param` toolsnap.
- The Legacy* variant exposes the original schema with no `fields`
  parameter and never filters, acting as a kill switch when the flag is
  off. It owns the canonical toolsnap.

Add best-effort, low-cardinality telemetry at each tool's filter point to
measure adoption and realized savings:

- `mcp.fields.tool_call` (increment) tagged by tool and whether the
  response was filtered.
- `mcp.fields.bytes_full` / `bytes_sent` / `bytes_saved` (counters) tagged
  by tool, emitted only when a response was filtered.

Tags are limited to `tool` and `filtered` to bound cardinality; repo,
owner, user, query, and the requested field list are never tagged. The
local server discards these via the noop metrics sink, while hosted
deployments inject a real sink. Metrics accessors now fall back to a noop
sink when no exporter is configured so emitting telemetry never panics.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Drop mcp.fields.bytes_saved metric

Remove the mcp.fields.bytes_saved counter. It is derivable on the
dashboard from the two remaining byte counters, since
sum(bytes_full) - sum(bytes_sent) equals the total saved at any rollup,
so emitting it separately is redundant. Keeping only bytes_full and
bytes_sent shrinks the emitted telemetry surface.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-07-10 09:50:47 +01:00
Tommaso Moro 778f5bb6a3 chore(deps): bump go-github v87 → v89 and resolve breaking changes (#2840) 
* chore(deps): bump go-github v87 -> v89 and resolve breaking changes

Bumps google/go-github from v87 to v89 across the module and fixes the
resulting breaking changes. No tool or behavior changes.

- Rewrite all import paths go-github/v87 -> go-github/v89.
- gists.go: Gists.Create now takes CreateGistRequest by value and
  Gists.Edit is renamed to Gists.Update taking UpdateGistRequest.
- repositories_test.go: adapt to RepositoryRelease fields that became
  value types in v89 (ID, TagName, Draft).
- Regenerate third-party license files for the new module path.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Don't clear gist description on update when omitted

update_gist always sent Description as a pointer to the OptionalParam
zero value (""), so omitting description would overwrite an existing gist
description with an empty string. Only set UpdateGistRequest.Description
when the caller actually provided the argument; an explicit empty string
still clears it. Adds a test asserting the description key is absent from
the PATCH body when omitted and present when set.

This addresses a pre-existing behavior surfaced while migrating to the
v89 gist request types.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-07-08 15:08:59 +01:00
Tim Rogers 8cd03c0185 Add reaction tools for issues and pull requests (#2732)
Docker / build (push) Has been cancelled
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
CodeQL / Analyze (javascript) (push) Has been cancelled
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
GoReleaser Release / release (push) Has been cancelled
MCP Server Diff / mcp-diff (push) Has been cancelled
MCP Server Diff / mcp-diff-http (push) Has been cancelled
Publish to MCP Registry / publish (push) Has been cancelled
* Add reaction tools for issues and pull requests

Implement three granular-only tools for adding emoji reactions:
- add_issue_reaction: Add reaction to an issue
- add_issue_comment_reaction: Add reaction to an issue comment
- add_pull_request_review_comment_reaction: Add reaction to a PR review comment

All tools are feature-flagged with FeatureFlagEnable set to enable them
only when clients request granular toolsets. Tools use go-github's
Reactions service and return minimal ID response on success (HTTP 201).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Make reaction tools available in both granular and non-granular modes

Remove feature flag gates from reaction tools so they're available to all
clients regardless of granular toolset preference. Reaction tools are
naturally atomic operations and work equally well in both modes.

Updates test expectations to exclude reaction tools from granular-only
test assertions, since they're now always available.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Update toolsnaps with aligned reaction tool descriptions

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Align reaction tool descriptions with codebase style

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Improve reaction tool responses and wording

Return reaction URLs in minimal responses and clarify issue tools apply to pull requests where applicable.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Expose reactions through default comment tools

Keep the standalone reaction tools behind granular feature flags to avoid expanding the default tool count. Add optional reaction support to the existing issue comment and pull request comment reply tools, requiring at least one of body or reaction.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Clarify PR review comment IDs for reactions

Document that PR review comment reaction inputs require the numeric review comment ID, not the GraphQL review thread node ID returned by review thread APIs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Support issue comment reactions in add_issue_comment

Add optional comment_id support so the default add_issue_comment tool can react to a specific issue or pull request comment without exposing a separate default reaction tool. Keep body creation tied to issue_number and require reaction targets to provide either issue_number or comment_id.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Harden combined comment reaction tools

Apply reactions before creating comments or replies so retrying a failed combined call cannot duplicate the non-idempotent comment operation.

Also reject issue comment IDs without a reaction target to avoid silently ignoring the field.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Group reaction tools with granular registrations

Keep standalone reaction tool registrations next to the granular issue and pull request tools they belong with, so the default compound tool sections stay focused.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Align granular reaction tool constructors

Rename the standalone reaction tool constructors to match the granular tool naming convention and clarify issue comment reaction IDs for pull request comments.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Require issue number for comment reactions

Make issue_number required on the consolidated add_issue_comment tool even when reacting to a specific issue comment, keeping the default tool input shape explicit.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address issue comment feedback

Return structured GitHub API errors for issue comment creation failures and assert MCP error results in tests.

Also reject comment_id with body on the consolidated comment tool to avoid ambiguous comment-plus-comment-reaction requests.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Validate issue comment reaction target

Use the required issue_number to verify issue comment reaction targets before creating the reaction, and remove overlapping add_issue_comment test coverage.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Validate positive comment IDs

Reject non-positive issue and pull request comment IDs in handlers and add the missing schema minimum for pull request review comment IDs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Sam Morrow <sammorrowdrums@github.com>
Co-authored-by: Sam Morrow <info@sam-morrow.com>
 2026-06-27 09:19:50 +02:00
Bryan Zwicker 067756a00a Add issue dependency read/write MCP tools (#2751) 
* Add issue dependency read/write MCP tools

Add two feature-flagged tools for issue blocked-by / blocking
relationships, gated behind the issue_dependencies flag so they stay off
the default tool surface (auto-enabled for insiders only):

- issue_dependency_read: get_blocked_by / get_blocking via the
  Issue.blockedBy / Issue.blocking GraphQL connections, cursor-paginated.
- issue_dependency_write: add / remove x blocked_by / blocking via the
  addBlockedBy / removeBlockedBy mutations. Accepts issue numbers and
  resolves them to node IDs in a single aliased query; "blocking" is the
  inverse of "blocked_by" with the subject/related roles swapped.

Closes the MCP gap behind the gh CLI dependency verbs (cli/cli#13057).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fail fast on self-dependency in issue_dependency_write

Reject a write where the subject and related issue are identical before
resolving node IDs or issuing a mutation, avoiding two API round-trips.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Revert addition of `any of` for required ui_get scopes

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-26 16:03:57 +02:00
Renee Xu a37837027f Promote issue fields and deprecate legacy issue write tool (#2696) 
* Promote issue fields FF and remove legacy issue write methods

* Remove legacy issue_write methods

* Remove feature flag

* Update tests

* Update tool snaps

* Update docs

* Remove legacy issue write from issues test

* Update tool snap

* Fix docs

* Include issue_fields in doc

* Remove issue fields FF check in ui tools

* Update UI tools test

* update docs

* Regenerate doc
 2026-06-19 14:09:47 +02:00
Koen Vlaswinkel f9a4dc5412 Add tool for getting code quality findings (#2604) 
Co-authored-by: Sam Morrow <info@sam-morrow.com>
 2026-06-17 12:19:11 +02:00
Matt Holloway 4e8eb81dac MCP Apps with extra functionality (#1974) 
* PoC full flow (hello world example)

* add avatar resource domain

* add postmessage logic and richer UI

* add create issue ui

* update ui for issue creatioon

* fix

* ignore banner

* update docs after rebase

* update toolsnap for get_me

* new UI changes

* update docs

* update workflows that need ui build

* add UI diff

* fix build ui step for windows runners to use git bash

* fix UI diff

* refactor issue creation UI

* add AvatarWithFallback component and update UserCard to use it; enhance CreateIssueApp to manage existing issue data

* fix formatting of button labels

* add create pull request functionality with UI support and insiders

* update docs

* add test for insiders mode handling in ServerTool schema

* remove `show_ui` param for now

* make insiders mode metadata stripping generic

* remove ui diff

* fix CI

* remove redundant mention of old app name

* add node types to fix ide issues for ts code

* remove unused TriangleDownIcon import

* update @primer/behaviors and electron-to-chromium versions in package-lock.json

* add check to ensure base and head are not the same when creating a new PR

* remove old show_ui

* fix gitignore for dist so builds dont break

* add tests for insiders mode handling and metadata stripping in ServerTool

* remove unused state and components from CreatePRApp

* fix ui build

* update docker build to fix npm issue

* remove reference to show_ui

* allow insiders to work for non-ui features

* formalise insiders inventory support

* update docs

* fix overflow issues and replace pull request dropdown with matching UI from dotcom

* fix createpullrequest test

* consolidate fetching tools under `ui_get` tool to remove toolset deps

* fix issue data prefill in issue_write form

* fix link component when updating issue

* fix avatar URL

* fix broken issue update logic

* remove dbg

* fix for new GetFlags

* revert to original required fields for create_pull_request

* fix for UI form submission

* Simplify MCP App UIs for basic branch

Remove advanced features to be kept in mcp-ui-apps-advanced:
- Strip labels, assignees, milestones, issue types, repo picker from issue-write
- Strip repo picker, branch selectors from pr-write
- Delete ui_get tool (ui_tools.go, ui_tools_test.go, ui_get.snap)
- Remove UIGet registration from tools.go

Basic forms retain: title, body, submit with _ui_submitted,
draft/regular split button (PR), MarkdownEditor, and SuccessView.

* Fix header spacing in issue-write and pr-write UIs

Add proper spacing between icon, title text, and repo name in the
header bar for both issue-write and create-pull-request forms.

* fix UI spacing

* Revert "Simplify MCP App UIs for basic branch"

This reverts commit 24174b91e222e45b47913ff6b760db809f48660b.

* Undo dependency downgrades in ui/package-lock.json

* Update ui/src/apps/pr-write/App.tsx

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update ui/src/apps/issue-write/App.tsx

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Implement pagination for uiGetBranches (#2012)

* Initial plan

* Implement pagination for uiGetBranches function

Co-authored-by: mattdholloway <918573+mattdholloway@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: mattdholloway <918573+mattdholloway@users.noreply.github.com>

* update to new insiders feature flag func

* ensure transient state is reset on successive tool calls

* Mark ui_get as app-only visibility

ui_get backs only the MCP App views and has no business in the agent's
tool list. Per the MCP Apps 2026-01-26 spec, omitting _meta.ui.visibility
defaults to ["model","app"], which exposes the tool to the model. Declare
visibility ["app"] so the host hides it from tools/list while the views can
still invoke it via tools/call.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Update ui_get toolsnap for app-only visibility

Regenerated via UPDATE_TOOLSNAPS to capture the new _meta.ui.visibility.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Assert ui_get declares app-only visibility

Locks in the _meta.ui.visibility ["app"] contract so a future edit can't
silently re-expose the UI data tool to the model.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add ui_get to insiders feature docs

Regenerated docs/feature-flags.md and docs/insiders-features.md to include
the ui_get tool entry.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address ui_get review feedback

- Paginate the labels GraphQL query (cursor-based) so repos with more than
  100 labels return a complete list instead of silently truncating.
- Emit an empty due_on for milestones without a due date instead of
  formatting the zero time as "0001-01-01".
- Use NewGitHubAPIErrorResponse in uiGetIssueTypes to preserve GitHub
  response context, matching the other REST-backed methods.
- Extend tests to cover the labels (GraphQL), milestones (including the
  no-due-date case) and issue_types methods, plus the issue_types error path.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix repo reset and stale base-branch in MCP App views

- Re-initialize selectedRepo from toolInput inside the reset-on-invocation
  effect instead of a separate effect. The two effects both depended on
  toolInput and ran in declaration order, so the reset wiped the just-
  initialized repo and the picker never reflected the invocation's owner/repo.
- Set the default base branch with a functional update in pr-write so a base
  prefilled from toolInput.base (or chosen by the user) isn't overwritten by
  a stale baseBranch value captured before the branches request resolved.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Fix issue-write repo owner mapping and clear stale UI state on reset

- issue-write: derive owner/name from full_name since search_repositories
  minimal output omits the owner object (mirrors pr-write)
- pr-write/issue-write: clear available branch/label/assignee/milestone/type
  lists and filters in the toolInput reset effect so prefill effects can't
  match against the previous repo's stale data

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Merge remote-tracking branch 'origin/main' into mcp-ui-apps-advanced

* feat: add pull request editing functionality with reviewers support

* feat: implement interactive form handling for issue and pull request creation and updates

* Close response body per page in ui_get pagination loops

Avoids leaking HTTP connections when paging through assignees,
milestones, branches, collaborators, and teams.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Cache pr-edit.html in build-ui action

The build-ui cache only saved get-me/issue-write/pr-write HTML, so once a
cache entry was stored it restored an incomplete ui_dist on later runs and
skipped the rebuild, leaving pr-edit.html absent and panicking the tests.
Add pr-edit.html to the cached paths and bump the cache key to v2 to evict
the incomplete entries.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: tommaso-moro <tommaso-moro@github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-16 16:45:16 +01:00
Mayowa Fajobi 1209da8eba feat: add get_file_blame tool for retrieving git blame information (#1538) 
* feat: add get_file_blame tool

* feat: implement cursor-based pagination for get_file_blame tool

* resolve annotated tags to their target commit in get_file_blame

* Regenerate get_file_blame toolsnap and docs after merge with main

The cursor-pagination parameter description changed on main; regenerate the
toolsnap and README so docs-check and toolsnap tests pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat: gate get_file_blame behind file_blame feature flag

The git blame tool adds a new tool to the inventory, which carries a
context-footprint cost for every client. Gate it behind a new
file_blame feature flag (user opt-in via --features / X-MCP-Features)
that is also auto-enabled in insiders mode, so it is not advertised by
default.

Regenerated README, feature-flags.md and insiders-features.md docs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Sam Morrow <sammorrowdrums@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-11 15:51:09 +02:00
Sam Morrow 014fd17fa3 feat: gate issue_write and get_issue behind remote_mcp_issue_fields flag 
Ports the gating from PR #2553 onto main (the original merge landed on a
stack base that did not make it to main).

Changes:
- pkg/inventory: FeatureFlagDisable becomes []string (any-listed-on → hide).
  FeatureFlagEnable stays as a single string. This avoids the AND-of-enable
  semantics from the earlier proposal, which encoded dependencies rather
  than rollout knobs and had no real call site. Disable-OR is the case
  that does need the slice (LegacyIssueWrite below).
- pkg/github/issues.go: split IssueWrite into IssueWrite (flag-enabled,
  exposes issue_fields) and LegacyIssueWrite (flag-disabled, omits it).
  Both register as 'issue_write'; mutually exclusive flag annotations
  pick exactly one at runtime. Refactored into a shared buildIssueWrite
  helper instead of duplicating the ~250-line tool definition.
- pkg/github/issues.go: GetIssue field_values enrichment now requires
  the flag at runtime. The verbose REST IssueFieldValues is always
  cleared from the response.
- Existing single-flag Disable call sites converted to slices.
- New toolsnap variant issue_write_ff_remote_mcp_issue_fields.snap; the
  canonical issue_write.snap is owned by LegacyIssueWrite.
- README + flag docs regenerated.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-05-28 13:11:29 +02:00
Sam Morrow f5e26a8540 feat(issues): gate issue-fields features behind remote_mcp_issue_fields flag (#2520) 
* feat(issues): gate issue-fields features behind remote_mcp_issue_fields flag

Gates the recently merged issue-fields work (list_issue_fields tool,
field_values enrichment on list_issues/search_issues, and field_filters
input on list_issues) behind a new feature flag, also enabled in
insiders mode.

- list_issues splits into two same-named registrations: the field-aware
  variant requires the flag, while LegacyListIssues (FeatureFlagDisable)
  preserves the prior schema and GraphQL selection set so disabled
  callers don't pay the extra wire/server cost.
- search_issues skips the field-values lookup when the flag is off.
- list_issue_fields requires the flag to be registered at all.
- Adopts <tool>_ff_<flag>.snap naming for flagged toolsnap variants so
  same-named duplicates each get a distinct snapshot.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: address PR review on issue-fields gating

- docs generator: install a no-flags feature checker so README reflects
  the default user experience (tools enabled with no special flags),
  fixing duplicate `list_issues` and removing granular/flagged-only
  tools that were never meant to appear in the default docs.
- csv_output: drop the FeatureFlagEnable/Disable exclusion in
  isCSVOutputTool. Wrapping happens before the per-request flag filter
  picks the live variant, so flag-gated list_* tools wrap safely; this
  restores CSV conversion for `list_issues` and enables it for
  `list_issue_fields` when both flags are on.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-05-21 23:01:19 +02:00
Ross Tarrant f929c58c6b feat: Add CSV output format for default list tools under insiders mode (#2450) 
* Add CSV output for list tools under insiders mode

* fix: resolve rebase feature flag conflicts

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Simplify feature-flag handling: collapse CSV dual-variant + skip filtering when no checker (#2516)

* refactor: generic toolset+name sort, clarify feature flag intent

Address review feedback on #2450:

- Collapse the three near-identical sort helpers in pkg/inventory/filters.go
  into a generic sortByToolsetThenName so adding new inventory item types
  doesn't require copying the comparator.
- Expand the doc comments on the three *WithoutFeatureFiltering helpers to
  spell out why they exist: HTTP mode builds a static (process-wide)
  inventory as an upper bound, but per-request feature flags from headers
  (X-MCP-Features, X-MCP-Insiders) are evaluated later, so feature-flagged
  variants must be preserved here.
- Strengthen the doc comment on ResolveFeatureFlags to make the contract
  explicit: user-supplied flags are validated against AllowedFeatureFlags,
  but insiders expansion deliberately is not — InsidersFeatureFlags may
  include server-controlled flags that are not user-toggleable.

CORS comments are intentionally left for the PR author.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs(feature-flags): clarify allowed and insiders sets are independent

Also add tests covering:
- a user-toggleable flag (FeatureFlagIssuesGranular) that insiders does
  not turn on automatically
- insiders mode not turning on user-only allowed flags

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* refactor(inventory): collapse three *WithoutFeatureFiltering helpers into StaticUpperBound

The three parallel methods (AvailableToolsWithoutFeatureFiltering,
AvailableResourceTemplatesWithoutFeatureFiltering,
AvailablePromptsWithoutFeatureFiltering) were always called as a triple
in exactly two places: HTTP buildStaticInventory and its test mirror.
They exist because the dual-variant pattern (sibling tools with mirrored
FeatureFlagEnable / FeatureFlagDisable on the same name, e.g. CSV output)
makes feature filtering at static-build time impossible — both variants
must be kept and resolved per-request.

Replace the three with one method, Inventory.StaticUpperBound(ctx), that
returns (tools, resources, prompts) and carries the rationale in its
doc comment. Reduces API surface, eliminates the triplication, and makes
the single "skip feature filtering" concept obvious to readers.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* refactor: simplify feature-flag handling

Two related simplifications, both about treating insiders as a meta flag
that expands once at startup and then stops mattering:

- Collapse CSV's dual-variant pattern into a single tool whose handler
  performs a runtime feature-flag check via deps.IsFeatureEnabled. CSV
  is a pure response-format toggle, not a schema change, so it does not
  need the dual-name pattern that genuine schema variants (granular
  issues/PRs) still use.

- When no feature checker is installed, skip feature-flag filtering and
  return the full upper bound. The static HTTP inventory now uses plain
  AvailableTools/Resources/Prompts; the per-request inventory always
  installs a checker, so MCP registration (which serves a tool name once)
  always sees a deduplicated set. The bespoke StaticUpperBound helper and
  the isToolEnabledWithFeatureFlags split go away.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci(mcp-diff): add insiders + per-feature configs

The mcp-diff matrix now includes:
  - --insiders (and --insiders --read-only)
  - one config per github.AllowedFeatureFlags entry, generated by
    script/print-mcp-diff-configs so new user-controllable flags get
    diffed automatically without editing the workflow

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs(insiders): explain feature-flag resolution for contributors

Adds a 'How feature flags are resolved' section covering:
  - Insiders is a meta flag, like 'all'/'default' for toolsets
  - User input -> allowlist filter -> insiders expansion ->
    server-side fallback (remote only)
  - AllowedFeatureFlags vs InsidersFeatureFlags are independent
  - How to add a new feature flag, including the
    TestGitHubPackageDoesNotReadInsidersMode guard

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* refactor(inventory): make feature-flag gating a regular ToolFilter

Move tool feature-flag evaluation out of isToolEnabled and into a
ToolFilter installed at the head of the pipeline by Build() when
WithFeatureChecker received a non-nil checker. The 'no checker = no
filtering' contract is now expressed structurally (the filter isn't
installed) instead of by a runtime nil check inside the helper.

Resources and prompts have no filter pipeline, so they call the now-pure
featureFlagAllowed helper behind an explicit r.featureChecker != nil
guard at the iteration site.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* perf(inventory): cache extracted toolset IDs in sort comparator

Avoid evaluating the extractor closures up to three times per comparison.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: correct MCP features header in cors

* docs: regenerate README for CSV output toolset

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: remove duplicate MCPFeaturesHeader from CORS headers

* ci(mcp-diff): add streamable-http job with header-based configs

Adds a sibling mcp-diff-http job that exercises the streamable-http
transport against a shared HTTP server, with per-config settings supplied
via X-MCP-* request headers — mirroring how the remote server is invoked
in production (server-side defaults + per-user header overrides).

The config generator gains a -transport flag:
- stdio (default, unchanged behaviour)
- http-headers (emits headers-only configs targeting a shared server)

Two new combined entries layer multiple headers together as a smoke test
for header-merging regressions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: regenerate after merging main

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Sam Morrow <info@sam-morrow.com>
Co-authored-by: sammorrowdrums <sammorrowdrums@github.com>
 2026-05-21 16:50:55 +02:00
Kelsey Myers 8f6050a5b8 Add list_issue_fields tool (#2445) 
* Add list_org_issue_fields tool

* Clean up code

* complete struct fields & rename option type

* Drop created_at/updated_at from IssueField and IssueSingleSelectFieldOption

* Address feedback

* Address Copilot review: close resp.Body, set expectError=true for missing org test

* Adjust to list_issue_fields

* Add feature flag

* Allow tool to support read:org or repo

* Docs

* address comments

* Add repo_issue_fields flag

---------

Co-authored-by: Michael Jacholke <46944669+michaeljacholke@users.noreply.github.com>
 2026-05-21 16:19:49 +02:00
Dhananjay Mishra 6b4ca78505 feat: Add search commit tool (#2284) 
* add `SearchCommits` tool

* run test

* run script/generate-docs

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* refactor(search_commits): share commit conversion, surface repo, tighten query docs

- Extract newMinimalCommitFromCore to share field mapping between
  convertToMinimalCommit (RepositoryCommit) and the new
  convertCommitResultToMinimalCommit (CommitResult), removing ~50
  lines of duplicated logic from the search_commits handler.
- Add MinimalRepoRef and a search-only MinimalCommitSearchItem type
  (embedding MinimalCommit) so cross-repo commit search results
  identify the repo each commit came from. Keeping the field off
  MinimalCommit avoids paying for a never-populated field on the
  get_commit/list_commits output types.
- Rewrite the query description to teach the model the actual
  commit-search qualifier surface (repo:/org:/user: scoping, author/
  committer/date qualifiers, hash/tree/parent, merge:, is:public)
  and reword the sort description to drop redundancy with the enum.
- Extend tests to assert the repository field is surfaced and to
  cover commits with no resolved GitHub user (nil Author/Committer).
- Refresh README and toolsnap.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Sam Morrow <info@sam-morrow.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-05-20 16:24:00 +02:00
Sam Morrow 0f0506d2fd refactor: remove dynamic toolsets and deprecated closure constructor (#2512) 
Dynamic toolset discovery (the meta-tools enable_toolset, list_available_toolsets,
get_toolset_tools and the --dynamic-toolsets / GITHUB_DYNAMIC_TOOLSETS switch)
was a local-only feature never offered by the remote server. Removing it
deletes a meaningful chunk of branching, configuration surface and tests
for a path no longer in active use.

The deprecated closure-based NewServerToolWithDeps generic constructor was
only kept around for the dynamic tool registration path and is removed
together with it. Going forward there are exactly two constructors:

- NewServerTool — raw mcp.ToolHandler, no closure, no unmarshalling
- NewServerToolWithContextHandler[In, Out] — typed handler, deps via context

Inventory methods that only existed for the dynamic path
(ToolsForToolset, IsToolsetEnabled, EnableToolset, EnabledToolsetIDs)
are removed. ResolvedEnabledToolsets loses its dynamic flag.

Also strips dynamic references from the README, server configuration
docs, copilot-instructions, mcp-diff workflow, and conformance-test
script.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-05-20 10:51:47 +02:00
Iulia Bejan 1861a351f8 Upgrade go-github from v82 to v87 (#2452) 
Breaking changes addressed:
- raw.NewClient: Use WithHTTPClient/WithEnterpriseURLs options, pass ctx to
  NewRequest, return (*Client, error)
- internal/ghmcp/server.go: Use functional options for REST client creation,
  replace UserAgent field mutation with UserAgentTransport wrapper, add
  restUATransp field to githubClients struct
- pkg/github/dependencies.go: Use functional options for REST client creation,
  handle raw.NewClient error return
- pkg/github/actions.go: Handle new WorkflowDispatchRunDetails return value
  from CreateWorkflowDispatchEventByID/ByFileName
- pkg/github/issues.go: Replace IssueListOptions with ListOptions for
  SubIssue.ListByIssue
- pkg/github/notifications.go: MarkThreadDone now takes string instead of
  int64; remove ParseInt and strconv import
- pkg/github/projects.go: Remove pointer indirection from
  ListProjectsPaginationOptions and ListProjectsOptions fields
- pkg/github/issues_granular.go: Pass ctx to NewRequest, remove ctx from Do
- Test files: Add mustNewGHClient helper, replace all NewClient calls,
  fix stubClientFnFromHTTP signature, fix lockdown_test.go BaseURL handling,
  fix raw_test.go, remove invalid threadID test case

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-05-18 14:36:23 +02:00
Ross Tarrant 8a48d0749f feat: Add tool for discussion comment write operations (#2427) 
* Add discussion comment write operation tools

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address comments from Copilot review

* Update includeReplies description to specify GitHub API maximum replies limit

* Consolidate into single tool

* add tests cases for checking param presence

* Enhance validation on discussion comment operations

* Enhance discussion_write tool description

Co-authored-by: Roberto Nacu <kerobbi@github.com>

* Remove redundant param

Co-authored-by: Roberto Nacu <kerobbi@github.com>

* Refactor tests

* Fix failing build

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Roberto Nacu <kerobbi@github.com>
 2026-05-15 15:16:36 +01:00
JoannaaKL 46d220fba5 Add tool to list repo collaborators (#2477) 
* Add tool to list repo collaborators

* Simplify tool description

* Fix test

* Return pagination info

* Return page parameters

* Update defaults
 2026-05-15 11:20:30 +02:00
Matt Holloway fc7a7dcdea feat: add granular tool to set issue field values 2026-04-16 15:11:24 +02:00
Sam Morrow a24c0be254 refactor: migrate MCP Apps from insiders mode to feature flag 
Rebase PR #2282 onto main (post-#2332) and unify feature flag
allowlists into a single source of truth.

- Add MCPAppsFeatureFlag, AllowedFeatureFlags, InsidersFeatureFlags,
  and ResolveFeatureFlags in feature_flags.go
- AllowedFeatureFlags includes all user-controllable flags (MCP Apps +
  granular), InsidersFeatureFlags only includes MCPAppsFeatureFlag
- HeaderAllowedFeatureFlags() now delegates to AllowedFeatureFlags
- Builder uses feature checker instead of insidersMode bool
- Remove InsidersOnly field from ServerTool and WithInsidersMode from
  Builder
- HTTP feature checker uses ResolveFeatureFlags for per-request
  resolution with insiders expansion
- Tool handlers check MCPAppsFeatureFlag via IsFeatureEnabled instead
  of InsidersMode

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-04-16 11:41:19 +02:00
Matt Holloway efcaead5b5 feat(http): update knownFeatureFlags to use HeaderAllowedFeatureFlags() and add tests for feature flag validation 2026-04-15 17:36:32 +02:00
Matt Holloway 7894292b65 Apply suggestion from @Copilot 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-04-15 17:36:32 +02:00
Matt Holloway 3cf4124dcf feat(http): implement HeaderAllowedFeatureFlags for X-MCP-Features header validation 2026-04-15 17:36:32 +02:00
Matt Holloway 62266f804b OSS granular PRs and issues toolsets (#2306)
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
Docker / build (push) Has been cancelled
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
MCP Server Diff / mcp-diff (push) Has been cancelled
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
CodeQL / Analyze (javascript) (push) Has been cancelled
GoReleaser Release / release (push) Has been cancelled
Publish to MCP Registry / publish (push) Has been cancelled
* initial OSS granular PRs and issues toolsets

* update docs

* refactor: reuse existing helpers in granular toolsets

Refactor granular issue and PR tools to delegate to existing tested
helper functions instead of reimplementing logic from scratch:

- Sub-issue tools (add/remove/reprioritize) now delegate to existing
  REST-based AddSubIssue, RemoveSubIssue, ReprioritizeSubIssue helpers
- PR review tools (create/submit/delete) now delegate to existing
  CreatePullRequestReview, SubmitPendingPullRequestReview,
  DeletePendingPullRequestReview helpers (fixes viewer filtering bug)
- Review comment tool now uses viewer-safe pattern from
  AddCommentToPendingReview (query viewer, filter by author, validate
  PENDING state, pass PullRequestReviewID)
- Fix milestone param to use RequiredInt instead of float64 cast
- Fix line/startLine params to use OptionalIntParam
- Draft state tool uses typed GraphQL inputs matching existing patterns
- Remove duplicate GraphQL types and helper functions
- Add toolsnap tests for all 20 granular tools
- Update generated docs

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* refactor: use feature flags instead of separate granular toolsets

Place granular tools in existing issues/pull_requests toolsets with
FeatureFlagEnable, instead of creating separate issues_granular and
pull_requests_granular toolsets. This is simpler and uses the existing
feature flag infrastructure to switch between consolidated and
granular tool variants at runtime.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: address review feedback on granular toolsets

- Fix REST response handling: capture resp, close body, use ghErrors
  helpers in issueUpdateTool, prUpdateTool, GranularCreateIssue, and
  GranularRequestPullRequestReviewers
- Add FeatureFlagDisable on consolidated tools (IssueWrite, SubIssueWrite,
  UpdatePullRequest, PullRequestReviewWrite, AddCommentToPendingReview)
  so they are hidden when granular variants are active
- Use OptionalStringArrayParam for assignees, labels, reviewers instead
  of manual loop that silently dropped non-string elements
- Fix side/startSide empty string leak: pass nil pointer when absent
  instead of pointer to empty string in GraphQL mutations
- Fix milestone minimum from 0 to 1 to match RequiredInt rejection of 0
- Return MinimalResponse {id, url} instead of full JSON objects
- Fix RequiredParam[bool] rejecting draft=false by using presence check
- Add handler tests for update_pull_request_draft_state (draft + ready)
  and add_pull_request_review_comment with full GraphQL mocking

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: address review feedback on granular toolsets

- Fix translation keys to use ALL_CAPS convention (strings.ToUpper)
- Fix assignees/labels clearing: check key presence instead of len==0
- Extract AddCommentToPendingReviewCall helper to deduplicate GraphQL
  logic between consolidated and granular tools
- Add missing granular tools: resolve_review_thread, unresolve_review_thread
  (were in pull_request_review_write but had no granular replacements)
- Add handler tests for new resolve/unresolve tools

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Sam Morrow <info@sam-morrow.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-04-14 15:40:00 +01:00
Sam Morrow 16ff74a0eb feat: move copilot tools to default copilot toolset (#2039) 
* feat: move copilot tools to default copilot toolset

Move AssignCopilotToIssue and RequestCopilotReview from the issues and
pull_requests toolsets respectively into a new default-enabled copilot
toolset. This groups all copilot-related tools together and makes them
available by default.

- Set Default: true on ToolsetMetadataCopilot
- Remove copilot from RemoteOnlyToolsets()
- Update AllTools() grouping and tests
- Regenerate docs

Refs: github/copilot-mcp-core#1180

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* refactor: move copilot tools to dedicated copilot.go

Extract AssignCopilotToIssue, RequestCopilotReview, AssignCodingAgentPrompt,
and all supporting types/helpers from issues.go and pullrequests.go into
copilot.go and copilot_test.go.

This follows the existing convention where each domain (actions, dependabot,
discussions, gists, etc.) has its own file, and keeps the copilot toolset
implementation cohesive in one place.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-02-23 11:38:26 +01:00
Oleksandr Redko 505d5dc33a refactor: modernize code with modernize and intrange 2026-02-12 12:58:49 +01:00
JoannaaKL 266bd9311e Gogithub update (#2004) 
* Bump google/go-github

* chore: regenerate license files

Auto-generated by license-check workflow

* Fix required block

* Go mod vendor and tidy again

* Remove unused fatih/color dependency to fix CI (#2005)

* Initial plan

* Remove unused github.com/fatih/color dependency

The fatih/color package was listed in go.mod but not actually imported
or used anywhere in the codebase. This caused the CI "go mod tidy -diff"
check to fail. Running go mod tidy removed:
- github.com/fatih/color v1.18.0
- github.com/mattn/go-colorable v0.1.13 (transitive)
- github.com/mattn/go-isatty v0.0.20 (transitive)

Fixes the failing ubuntu-latest workflow build.

Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
 2026-02-12 11:04:54 +01:00
copilot-swe-agent[bot] 3c53687eb3 Remove old non-consolidated actions and Projects toolsets 
This commit removes the old individual tool implementations for
Actions and Projects toolsets that have been superseded by consolidated
tools (actions_list, actions_get, actions_run_trigger, get_job_logs,
projects_list, projects_get, projects_write).

Removed old Actions tools:
- ListWorkflows, ListWorkflowRuns, RunWorkflow, GetWorkflowRun
- GetWorkflowRunLogs, ListWorkflowJobs, GetJobLogs
- RerunWorkflowRun, RerunFailedJobs, CancelWorkflowRun
- ListWorkflowRunArtifacts, DownloadWorkflowRunArtifact
- DeleteWorkflowRunLogs, GetWorkflowRunUsage

Removed old Projects tools:
- ListProjects, GetProject, ListProjectFields, GetProjectField
- ListProjectItems, GetProjectItem, AddProjectItem
- UpdateProjectItem, DeleteProjectItem

Also removed:
- Feature flag constants (FeatureFlagHoldbackConsolidatedActions/Projects)
- FeatureFlagDisable from consolidated tools
- Old toolsnaps for removed tools
- Tests for removed tools
- Unused helper function toNewProjectType

Co-authored-by: mattdholloway <918573+mattdholloway@users.noreply.github.com>
 2026-02-10 12:55:24 +01:00
Ilya Kamens a9edf9e04c Add reply to PR comment (#1856) 
* Update snapshots

There was a change on `main` before I changed anything

* feat: add add_reply_to_pull_request_comment tool

Add a new tool that allows AI agents to reply to existing pull request comments. This tool uses GitHub's CreateCommentInReplyTo REST API to create threaded conversations on pull requests.

Features:

Reply to any existing PR comment using its ID
Proper error handling for missing parameters and API failures
Comprehensive test coverage (8 test cases)
Follows project patterns and conventions
Registered in pull_requests toolset as a write operation
Parameters:

owner: Repository owner (required)
repo: Repository name (required)
pullNumber: Pull request number (required)
commentId: ID of comment to reply to (required)
body: Reply text content (required)
This tool complements the existing add_comment_to_pending_review tool by enabling responses to already-posted comments, enhancing AI-powered code review workflows.

Closes: #635

* Update README

* fix types

---------

Co-authored-by: tommaso-moro <tommaso-moro@github.com>
Co-authored-by: Tommaso Moro <37270480+tommaso-moro@users.noreply.github.com>
Co-authored-by: plaskowski <1999603+plaskowski@users.noreply.github.com>
Co-authored-by: Rob Emanuele <2320142+lossyrob@users.noreply.github.com>
 2026-02-04 17:46:21 +00:00
Tommaso Moro 15e66b3df3 Generate server instructions in Inventory (#1869) 
* carry over from https://github.com/github/github-mcp-server/pull/1863

* remove unused inv

* update toolsnap

---------

Co-authored-by: Sam Morrow <info@sam-morrow.com>
 2026-01-23 09:57:47 +00:00
Tommaso Moro 19beb33c3f Bug fix: invalid tool should error out (#1776) 
* get it working

* clean up approach by moving cleantools inside builder, this simplifies remote server too

* add tests for trimming and deduplication

* error out in the builder if there are unrecognized tools

---------

Co-authored-by: Sam Morrow <info@sam-morrow.com>
 2026-01-15 17:37:06 +01:00
Matt Holloway 66a01645f8 initial projects consolidation 2026-01-06 17:38:12 +00:00
tommaso-moro b5be18c958 remove experiments toolset 2025-12-22 10:15:52 +00:00
Matt Holloway 511121f09c add ff saupport and consolidated actions toolsets 2025-12-18 16:00:31 +01:00
Sam Morrow 6b3c375492 feat: Add Octicon icons to MCP tools, resources, and prompts (#1603) 
* Upgrade MCP Go SDK to v1.2.0-pre.1 and add Octicon icons to tools

- Upgrade MCP Go SDK from v1.1.0 to v1.2.0-pre.1 for Icon support
- Add Icon field to ToolsetMetadata for Octicon name assignment
- Add OcticonURL() helper to generate CDN URLs for Octicon SVGs
- Add Icons() method on ToolsetMetadata to generate MCP Icon objects
- Apply icons automatically in RegisterFunc when tool is registered
- Add icons to all 22 toolset metadata constants with appropriate Octicons
- Update server.go to use new Capabilities API (fixes deprecation warnings)

This demonstrates how the toolsets refactor makes adding new features simpler:
icons are defined once in ToolsetMetadata and automatically applied to all
tools in that toolset during registration.

* Update third-party licenses for SDK upgrade

* Address review feedback: enum size validation, mutation fix, tests

- Replace runtime size validation with compile-time enum type (Size with SizeSM=16, SizeLG=24)
- Fix RegisterFunc mutation by making shallow copy of tool before modifying Icons
- Add comprehensive tests for octicons package (URL, Icons, Size constants)
- Add toolsets tests for ToolsetMetadata.Icons(), RegisterFunc mutation prevention,
  and existing icon preservation
- Improve icon choices for better visual semantics:
  - actions: play → workflow (more specific to GitHub Actions)
  - secret_protection: key → shield-lock (better represents protection)
  - gists: code → logo-gist (dedicated gist icon exists)

* Add GitHub mark icon to server metadata

Add the mark-github octicon to the server's Implementation struct
so that MCP clients can display the GitHub logo for this server.
The icon is provided in both 16x16 and 24x24 SVG sizes.

* Fix rebase conflicts: use Registry methods and NullTranslationHelper

- Remove duplicate old toolsets functions (AvailableToolsets, GetValidToolsetIDs, GetDefaultToolsetIDs)
- Use Registry.AvailableToolsets() and Registry.HasToolset() instead
- Replace stubTranslator with translations.NullTranslationHelper
- Use new SDK Capabilities struct instead of deprecated HasTools/HasResources/HasPrompts
- Add icon-related tests to registry_test.go

* Use embedded data URIs for Octicon icons

- Embed SVG icons using go:embed for offline use and faster loading
- Convert icons to base64 data URIs at runtime
- Fall back to CDN URL for non-embedded icons
- Add test to verify all toolset icons are properly embedded
- 44 SVG files (22 icons × 2 sizes) totaling ~27KB

* Convert icons from SVG to PNG for MCP client compatibility

MCP clients don't support SVG data URIs, so convert all embedded icons
to PNG format using rsvg-convert.

Changes:
- Convert all 44 SVG icons to PNG format
- Add 8 new icons: copilot, git-merge, repo-forked, star-fill
- Update octicons.go to use PNG MIME type
- Add script/fetch-icons for easy icon management
- Update tests and toolsnaps for PNG format

* Add mark-github icon for server metadata

* Add light/dark theme icons for tools, resources, and prompts

- Switch from size-based (16/24px) to theme-based (light/dark) icons
- Use only 16x16 icons for smaller bundle size
- Generate white (inverted) icons for dark theme backgrounds
- Add icons to resources and prompts (auto-applied from toolset metadata)
- Add 'file' icon for repository content resources
- Update fetch-icons script to generate both theme variants

* Use 24px icons with SVG fill modification for themes

- Switch from 16px to 24px icons for better visibility
- Use SVG fill attribute (#24292f for light, #ffffff for dark) instead
  of ImageMagick color inversion for cleaner theme variants
- Remove ImageMagick dependency from fetch-icons script

* Add specific icons for each repository resource type

- repository_content: repo icon
- repository_content_branch: git-branch icon
- repository_content_commit: git-commit icon (new)
- repository_content_tag: tag icon
- repository_content_pr: git-pull-request icon

Resources now have explicit icons set rather than relying on toolset fallback.

* fix: restore Icon fields to toolset metadata and add icons to docs

- Add Icon field to all ToolsetMetadata definitions (lost during rebase conflict resolution)
- Update doc generator to include Octicon icons in toolsets table
- Update doc generator to include icons in tool section headers
- Use Primer Octicons CDN for GitHub markdown compatibility

* feat: add icons to individual tools in documentation

* fix: use repo-local icons with picture element for GitHub theme support

- Reference icons from pkg/octicons/icons/ instead of external CDN
- Use picture element with prefers-color-scheme for light/dark mode
- GitHub markdown renderer will display these correctly

* fix: remove redundant icons from individual tools

Icons are kept on section headers and toolsets table only - having the same
icon on every tool within a section was visually noisy and redundant.

* Add icons to remote server toolsets documentation

* Fix icon paths for docs/remote-server.md

* Add remote-only toolsets with auto-generated documentation and icons guide

- Add ToolsetMetadataCopilot, ToolsetMetadataCopilotSpaces, ToolsetMetadataSupportSearch
- Add RemoteOnlyToolsets() function to return remote-only toolset metadata
- Update doc generator to auto-generate remote-only toolsets table with icons
- Create docs/toolsets-and-icons.md explaining how to add icons to toolsets
- Add link to icons guide in CONTRIBUTING.md

* Add icon validation tests and single source of truth for required icons

- Add pkg/octicons/required_icons.txt as single source of truth for icons
- Add RequiredIcons() function to read the required icons list
- Update script/fetch-icons to read from required_icons.txt
- Update octicons_test.go to use RequiredIcons() instead of hardcoded list
- Add pkg/github/toolset_icons_test.go with:
  - TestAllToolsetIconsExist: validates all toolset icons are embedded
  - TestToolsetMetadataHasIcons: ensures all toolsets have icons set
- Add 'book' icon for SupportSearch toolset
- Update docs/toolsets-and-icons.md with fetch-icons and CI validation docs

* fix: remove unused icon parameter from writeToolDoc

- Remove unused 'icon' parameter from writeToolDoc function signature
- Fix whitespace inconsistency in octicons_test.go
- Fixes lint failure: unused-parameter revive error

* fix: combine icon with name column in remote docs for proper table rendering

- Move icon from separate column to Name column with <br> separator
- Keep <picture> element for light/dark theme support
- Remove empty icon column that was collapsing to zero width
- Remove unused octiconSimpleImg function
 2025-12-17 17:31:13 +01:00
Sam Morrow ce2e4f9472 refactor: Introduce Inventory pattern with builder, filtering, and per-request optimization (#1589) 
* refactor: separate ServerTool into own file with HandlerFunc pattern

- Extract ServerTool struct into pkg/toolsets/server_tool.go
- Add ToolDependencies struct for passing common dependencies to handlers
- HandlerFunc allows lazy handler generation from Tool definitions
- NewServerTool for new dependency-based tools
- NewServerToolLegacy for backward compatibility with existing handlers
- Update toolsets.go to store and pass dependencies
- Update all call sites to use NewServerToolLegacy

Co-authored-by: Adam Holt <4619+omgitsads@users.noreply.github.com>

* Wire ToolDependencies through toolsets

- Move ToolDependencies to pkg/github/dependencies.go with proper types
- Use 'any' in toolsets package to avoid circular dependencies
- Add NewTool/NewToolFromHandler helpers that isolate type assertion
- Tool implementations will be fully typed with no assertions scattered
- Infrastructure ready for incremental tool migration

* refactor(search): migrate search tools to new ServerTool pattern

Migrate search.go tools (SearchRepositories, SearchCode, SearchUsers,
SearchOrgs) to use the new NewTool helper and ToolDependencies pattern.

- Functions now take only TranslationHelperFunc and return ServerTool
- Handler generation uses ToolDependencies for typed access to clients
- Update tools.go call sites to remove getClient parameter
- Update tests to use new Handler(deps) pattern

This demonstrates the migration pattern for additional tool files.

Co-authored-by: Adam Holt <omgitsads@users.noreply.github.com>

* Migrate context_tools to new ServerTool pattern (#1590)

* refactor(search): migrate search tools to new ServerTool pattern

Migrate search.go tools (SearchRepositories, SearchCode, SearchUsers,
SearchOrgs) to use the new NewTool helper and ToolDependencies pattern.

- Functions now take only TranslationHelperFunc and return ServerTool
- Handler generation uses ToolDependencies for typed access to clients
- Update tools.go call sites to remove getClient parameter
- Update tests to use new Handler(deps) pattern

This demonstrates the migration pattern for additional tool files.

Co-authored-by: Adam Holt <oholt@github.com>

* Migrate context_tools to new ServerTool pattern

Convert GetMe, GetTeams, and GetTeamMembers to use the new typed
dependency injection pattern:
- Functions now take only translations helper, return toolsets.ServerTool
- Handler is generated lazily via deps.GetClient/deps.GetGQLClient
- Tests updated to use serverTool.Handler(deps) pattern
- Fixed error return pattern to return nil for Go error (via result.IsError)

Co-authored-by: Adam Holt <omgitsads@users.noreply.github.com>

* refactor(gists): migrate gists.go to NewTool pattern (#1591)

* Migrate context_tools to new ServerTool pattern

Convert GetMe, GetTeams, and GetTeamMembers to use the new typed
dependency injection pattern:
- Functions now take only translations helper, return toolsets.ServerTool
- Handler is generated lazily via deps.GetClient/deps.GetGQLClient
- Tests updated to use serverTool.Handler(deps) pattern
- Fixed error return pattern to return nil for Go error (via result.IsError)

Co-authored-by: Adam Holt <oholt@github.com>

* refactor(gists): migrate gists.go to NewTool pattern

Convert all gist tools (ListGists, GetGist, CreateGist, UpdateGist)
to use the new NewTool helper with ToolDependencies injection.

- Remove getClient parameter from function signatures
- Use deps.GetClient(ctx) inside handlers
- Standardize error handling with utils.NewToolResultErrorFromErr()
- Update all tests to use serverTool.Handler(deps) pattern

Co-authored-by: Adam Holt <omgitsads@users.noreply.github.com>

---------

Co-authored-by: Adam Holt <oholt@github.com>
Co-authored-by: Adam Holt <omgitsads@users.noreply.github.com>

---------

Co-authored-by: Adam Holt <oholt@github.com>
Co-authored-by: Adam Holt <omgitsads@users.noreply.github.com>

* refactor(notifications): migrate notifications.go to NewTool pattern (#1592)

* refactor(notifications): migrate notifications.go to NewTool pattern

Convert all notification tools to use the new NewTool helper with
ToolDependencies injection.

Co-authored-by: Adam Holt <omgitsads@users.noreply.github.com>

* Refactor repositories.go tools to use NewTool pattern with ToolDependencies

Convert all 18 tool functions in repositories.go to use the new NewTool helper
pattern with typed ToolDependencies, isolating type assertions to a single
location and improving code maintainability.

Functions converted:
- GetCommit, ListCommits, ListBranches
- CreateOrUpdateFile, CreateRepository, GetFileContents
- ForkRepository, DeleteFile, CreateBranch, PushFiles
- ListTags, GetTag, ListReleases, GetLatestRelease, GetReleaseByTag
- ListStarredRepositories, StarRepository, UnstarRepository

This is part of a stacked PR series to systematically migrate all tool
files to the new pattern.

Co-authored-by: Adam Holt <omgitsads@users.noreply.github.com>

* refactor(issues): migrate issues.go to NewTool pattern

Convert all 8 tool functions in issues.go to use the new NewTool
helper pattern which standardizes dependency injection:

- IssueRead: GetClient, GetGQLClient, RepoAccessCache, Flags
- ListIssueTypes: GetClient
- AddIssueComment: GetClient
- SubIssueWrite: GetClient
- SearchIssues: GetClient
- IssueWrite: GetClient, GetGQLClient
- ListIssues: GetGQLClient
- AssignCopilotToIssue: GetGQLClient

Updated tools.go to use direct function calls instead of
NewServerToolLegacy wrappers. Updated all tests in issues_test.go
to use the new ToolDependencies pattern and Handler() method.

Co-authored-by: Adam Holt <omgitsads@users.noreply.github.com>

* refactor(pullrequests): convert PR tools to NewTool pattern

Convert all 10 pull request tool functions to use the NewTool
pattern with ToolDependencies injection:
- PullRequestRead
- CreatePullRequest
- UpdatePullRequest
- ListPullRequests
- MergePullRequest
- SearchPullRequests
- UpdatePullRequestBranch
- PullRequestReviewWrite
- AddCommentToPendingReview
- RequestCopilotReview

Update tools.go to use direct function calls (removing
NewServerToolLegacy wrappers) for PR functions.

Update all tests in pullrequests_test.go to use the new
handler pattern with deps and 2-value return.

Co-authored-by: Adam Holt <omgitsads@users.noreply.github.com>

* Refactor actions.go to use NewTool pattern

Convert all 14 tool functions in actions.go to use the NewTool pattern with
ToolDependencies for dependency injection. This is part of a broader effort
to standardize the tool implementation pattern across the codebase.

Changes:
- ListWorkflows, ListWorkflowRuns, RunWorkflow, GetWorkflowRun
- GetWorkflowRunLogs, ListWorkflowJobs, GetJobLogs
- RerunWorkflowRun, RerunFailedJobs, CancelWorkflowRun
- ListWorkflowRunArtifacts, DownloadWorkflowRunArtifact
- DeleteWorkflowRunLogs, GetWorkflowRunUsage

The new pattern:
- Takes only translations.TranslationHelperFunc as parameter
- Returns toolsets.ServerTool with Tool and Handler
- Handler receives ToolDependencies for client access
- Enables better testability and consistent interface

Co-authored-by: Adam Holt <omgitsads@users.noreply.github.com>

* refactor(git): migrate GetRepositoryTree to NewTool pattern

* refactor(security): migrate code_scanning, secret_scanning, dependabot to NewTool pattern

Co-authored-by: Adam Holt <omgitsads@users.noreply.github.com>

* refactor(discussions): migrate to NewTool pattern

Co-authored-by: Adam Holt <omgitsads@users.noreply.github.com>

* Refactor security_advisories tools to use NewTool pattern

Convert 4 functions from NewServerToolLegacy wrapper to NewTool:
- ListGlobalSecurityAdvisories
- GetGlobalSecurityAdvisory
- ListRepositorySecurityAdvisories
- ListOrgRepositorySecurityAdvisories

Update tools.go toolset registration and tests.

Co-authored-by: Adam Holt <omgitsads@users.noreply.github.com>

* refactor: convert projects, labels, and dynamic_tools to NewTool pattern

This PR converts projects.go, labels.go, and dynamic_tools.go from the
legacy NewServerToolLegacy wrapper pattern to the new NewTool pattern with
proper ToolDependencies.

Changes:
- projects.go: Convert all 9 project functions to use NewTool with
  ToolHandlerFor[map[string]any, any] and 3-return-value handlers
- projects_test.go: Update tests to use new serverTool.Handler(deps) pattern
- labels.go: Convert GetLabel, ListLabels, and LabelWrite to NewTool pattern
- labels_test.go: Update tests to use new pattern
- dynamic_tools.go: Refactor functions to return ServerTool directly
  (using NewServerToolLegacy internally since they have special dependencies)
- tools.go: Remove NewServerToolLegacy wrappers for dynamic tools registration

Co-authored-by: Adam Holt <omgitsads@users.noreply.github.com>

* Add --features CLI flag for feature flag support

Add CLI flag and config support for feature flags in the local server:

- Add --features flag to main.go (StringSlice, comma-separated)
- Add EnabledFeatures field to StdioServerConfig and MCPServerConfig
- Create createFeatureChecker() that builds a set from enabled features
- Wire WithFeatureChecker() into the toolset group filter chain

This enables tools/resources/prompts that have FeatureFlagEnable set to
a flag name that is passed via --features. The checker uses a simple
set membership test for O(1) lookup.

Usage:
  github-mcp-server stdio --features=my_feature,another_feature
  GITHUB_FEATURES=my_feature github-mcp-server stdio

* Add validation tests for tools, resources, and prompts metadata

This commit adds comprehensive validation tests to ensure all MCP items
have required metadata:

- TestAllToolsHaveRequiredMetadata: Validates Toolset.ID and Annotations
- TestAllToolsHaveValidToolsetID: Ensures toolsets are in AvailableToolsets()
- TestAllResourcesHaveRequiredMetadata: Validates resource metadata
- TestAllPromptsHaveRequiredMetadata: Validates prompt metadata
- TestToolReadOnlyHintConsistency: Validates IsReadOnly() matches annotation
- TestNoDuplicate*Names: Ensures unique names across tools/resources/prompts
- TestAllToolsHaveHandlerFunc: Ensures all tools have handlers
- TestDefaultToolsetsAreValid: Validates default toolset IDs
- TestToolsetMetadataConsistency: Ensures consistent descriptions per toolset

Also fixes a bug discovered by these tests: ToolsetMetadataGit was defined
but not added to AvailableToolsets(), causing get_repository_tree to have
an invalid toolset ID.

* Fix default toolsets behavior when not in dynamic mode

When no toolsets are specified and dynamic mode is disabled, the server
should use the default toolsets. The bug was introduced when adding
dynamic toolsets support:

1. CleanToolsets(nil) was converting nil to empty slice
2. Empty slice passed to WithToolsets means 'no toolsets'
3. This resulted in zero tools being registered

Fix: Preserve nil for non-dynamic mode (nil = use defaults in WithToolsets)
and only set empty slice when dynamic mode is enabled without explicit
toolsets.

* refactor: address PR review feedback for toolsets

- Rename AddDeprecatedToolAliases to WithDeprecatedToolAliases for
  immutable filter chain consistency (returns new ToolsetGroup)
- Remove unused mockGetRawClient from generate_docs.go (use nil instead)
- Remove legacy ServerTool functions (NewServerToolLegacy and
  NewServerToolFromHandlerLegacy) - no usages
- Add panic in Handler()/RegisterFunc() when HandlerFunc is nil
- Add HasHandler() method for checking if tool has a handler
- Add tests for HasHandler and nil handler panic behavior
- Update all tests to use new WithDeprecatedToolAliases pattern

* refactor: Apply HandlerFunc pattern to resources for stateless NewToolsetGroup

This change applies the same HandlerFunc pattern used by tools to resources,
allowing NewToolsetGroup to be fully stateless (only requiring translations).

Key changes:
- Add ResourceHandlerFunc type to toolsets package
- Update ServerResourceTemplate to use HandlerFunc instead of direct Handler
- Add HasHandler() and Handler(deps) methods to ServerResourceTemplate
- Update RegisterResourceTemplates to take deps parameter
- Refactor repository resource definitions to use HandlerFunc pattern
- Make AllResources(t) stateless (only takes translations)
- Make NewToolsetGroup(t) stateless (only takes translations)
- Update generate_docs.go - no longer needs mock clients
- Update tests to use new patterns

This resolves the concern about mixed concerns in doc generation - the
toolset metadata and resource templates can now be created without any
runtime dependencies, while handlers are generated on-demand when deps
are provided during registration.

* refactor: simplify ForMCPRequest switch cases

* refactor(generate_docs): use strings.Builder and AllTools() iteration

- Replace slice joining with strings.Builder for all doc generation
- Iterate AllTools() directly instead of ToolsetIDs()/ToolsForToolset()
- Removes need for special 'dynamic' toolset handling (no tools = no output)
- Context toolset still explicitly handled for custom description
- Consistent pattern across generateToolsetsDoc, generateToolsDoc,
  generateRemoteToolsetsDoc, and generateDeprecatedAliasesTable

* feat(toolsets): add AvailableToolsets() with exclude filter

- Add AvailableToolsets() method that returns toolsets with actual tools
- Support variadic exclude parameter for filtering out specific toolsets
- Simplifies doc generation by removing manual skip logic
- Naturally excludes empty toolsets (like 'dynamic') without special cases

* refactor(generate_docs): hoist success logging to generateAllDocs

* refactor: consolidate toolset validation into ToolsetGroup

- Add Default field to ToolsetMetadata and derive defaults from metadata
- Move toolset validation into WithToolsets (trims whitespace, dedupes, tracks unrecognized)
- Add UnrecognizedToolsets() method for warning about typos
- Add DefaultToolsetIDs() method to derive defaults from metadata
- Remove redundant functions: CleanToolsets, GetValidToolsetIDs, AvailableToolsets, GetDefaultToolsetIDs
- Update DynamicTools to take ToolsetGroup for schema enum generation
- Add stubTranslator for cases needing ToolsetGroup without translations

This eliminates hardcoded toolset lists - everything is now derived from
the actual registered tools and their metadata.

* refactor: rename toolsets package to registry with builder pattern

- Rename pkg/toolsets to pkg/registry (better reflects its purpose)
- Split monolithic toolsets.go into focused files:
  - registry.go: Core Registry struct and MCP methods
  - builder.go: Builder pattern for creating Registry instances
  - filters.go: All filtering logic (toolsets, read-only, feature flags)
  - resources.go: ServerResourceTemplate type
  - prompts.go: ServerPrompt type
  - errors.go: Error types
  - server_tool.go: ServerTool and ToolsetMetadata (existing)
- Fix lint: Rename RegistryBuilder to Builder (avoid stuttering)
- Update all imports across ~45 files

This refactoring improves code organization and makes the registry's
purpose clearer. The builder pattern provides a clean API:

  reg := registry.NewBuilder().
      SetTools(tools).
      WithReadOnly(true).
      WithToolsets([]string{"repos"}).
      Build()

* fix: remove unnecessary type arguments in helper_test.go

* fix: restore correct behavior for --tools and --toolsets flags

Two behavioral regressions were fixed in resolveEnabledToolsets():

1. When --tools=X is used without --toolsets, the server should only
   register the specified tools, not the default toolsets. Now returns
   an empty slice instead of nil when EnabledTools is set.

2. When --toolsets=all --dynamic-toolsets is used, the 'all' and 'default'
   pseudo-toolsets should be removed so only the dynamic management tools
   are registered. This matches the original pre-refactor behavior.

* Move labels tools to issues toolset

Labels are closely related to issues - you add labels to issues,
search issues by label, etc. Keeping them in a separate toolset
required users to explicitly enable 'labels' to get this functionality.

Moving to issues toolset makes labels available by default since
issues is a default toolset.

* Restore labels toolset with get_label in both issues and labels

This restores conformance with the original behavior where:
- get_label is in issues toolset (read-only label access for issue workflows)
- get_label, list_label, label_write are in labels toolset (full management)

The duplicate get_label registration is intentional - it was in both toolsets
in the original implementation. Added test exception to allow this case.

* Fix instruction generation and capability advertisement

- Expand nil toolsets to default IDs before GenerateInstructions
  (nil means 'use defaults' in registry but instructions need actual names)
- Remove unconditional HasTools/HasResources/HasPrompts=true in NewServer
  (let SDK determine capabilities based on registered items, matching main)

* Add tests for dynamic toolset management tools

Tests cover:
- list_available_toolsets: verifies toolsets are listed with enabled status
- get_toolset_tools: verifies tools can be retrieved for a toolset
- enable_toolset: verifies toolset can be enabled and marked as enabled
- enable_toolset invalid: verifies proper error for non-existent toolset
- toolsets enum: verifies tools have proper enum values in schema

* Advertise all capabilities in dynamic toolsets mode

In dynamic mode, explicitly set HasTools/HasResources/HasPrompts=true
since toolsets with those capabilities can be enabled at runtime.
This ensures clients know the server supports these features even
when no tools/resources/prompts are initially registered.

* Improve conformance test with dynamic tool calls and JSON normalization

- Add dynamic tool call testing (list_available_toolsets, get_toolset_tools, enable_toolset)
- Parse and sort embedded JSON in text fields for proper comparison
- Separate progress output (stderr) from summary (stdout) for CI
- Add test type field to distinguish standard vs dynamic tests

* Add conformance-report to .gitignore

* Add conformance test CI workflow

- Runs on pull requests to main
- Compares PR branch against merge-base with origin/main
- Outputs full conformance report to GitHub Actions Job Summary
- Uploads detailed report as artifact for deeper investigation
- Does not fail the build on differences (may be intentional)

* Add map indexes for O(1) lookups in Registry

Address review feedback to use maps for collections. Added lookup maps
(toolsByName, resourcesByURI, promptsByName) while keeping slices for
ordered iteration. This provides O(1) lookup for:

- FindToolByName
- filterToolsByName (used by ForMCPRequest)
- filterResourcesByURI
- filterPromptsByName

Maps are built once during Build() and shared in ForMCPRequest copies.

* perf(registry): O(1) HasToolset lookup via pre-computed set

Add toolsetIDSet (map[ToolsetID]bool) to Registry for O(1) HasToolset lookups.
Previously HasToolset iterated through all tools, resourceTemplates, and prompts
to check if any belonged to the given toolset. Now it's a simple map lookup.

The set is populated during the single-pass processToolsets() call, which already
collected all valid toolset IDs. This adds zero new iteration - just returns the
existing validIDs map.

processToolsets now returns 6 values:
- enabledToolsets, unrecognized, toolsetIDs, toolsetIDSet, defaultToolsetIDs, descriptions

* simplify: remove lazy toolsByName map - not needed for actual use cases

FindToolByName() is only called once per request at most (to find toolset ID
for dynamic enablement). The SDK handles tool dispatch after registration.

A simple linear scan over ~90 tools is trivially fast and avoids:
- sync.Once complexity
- Map allocation
- Premature optimization for non-existent 'repeated lookups'

The pre-computed maps we keep (toolsetIDSet, etc.) are justified because
they're used for filtering logic that runs on every request.

* Add generic tool filtering mechanisms to registry package

- Add Enabled field to ServerTool for self-filtering based on context
- Add ToolFilter type and WithFilter method to Builder for cross-cutting filters
- Update isToolEnabled to check Enabled function and builder filters in order:
  1. Tool's Enabled function
  2. Feature flags (FeatureFlagEnable/FeatureFlagDisable)
  3. Read-only filter
  4. Builder filters
  5. Toolset/additional tools check
- Add FilteredTools method to Registry as alias for AvailableTools
- Add comprehensive tests for all new functionality
- All tests pass and linter is clean

Closes #1618

Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>

* docs: improve filter evaluation order and FilteredTools documentation

- Add numbered filter evaluation order to isToolEnabled function doc
- Number inline comments for each filter step (1-5)
- Clarify FilteredTools error return is for future extensibility
- Document that library consumers may need to surface recoverable errors

Addresses review feedback on PR #1620

* Refactor GenerateToolsetsHelp() to use strings.Builder pattern

Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>

---------

Co-authored-by: Adam Holt <omgitsads@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>

* Port functional changes from main to registry pattern

Port three functional improvements from main branch:
- GraphQL review comments grouped as threads (#1554)
- get_file_contents description improvement (#1582)
- create_or_update_file SHA validation fix (#1621)

Adapted implementations to use the new registry pattern with:
- BaseDeps for providing clients via ToolDependencies interface
- deps.GetClient(ctx) and deps.GetGQLClient(ctx) patterns
- Updated tests to use GraphQL mocks for review comments
- Added SHA validation test cases for create_or_update_file

* fix(e2e): Fix e2e test compilation and add rate limit handling

- Fix DefaultToolsetIDs() type mismatch by using github.GetDefaultToolsetIDs()
- Add waitForRateLimit() to check and wait for rate limits before each test
- Add skip conditions for Copilot tests when Copilot isn't available
- Use multi-line file content in TestPullRequestReviewCommentSubmit for
  multi-line review comments to work correctly
- Improve error messages to include response details

* fix(gists): Use proper GitHub API error handling for observability

The gists.go file was using NewToolResultErrorFromErr for GitHub API
errors, which breaks the error middleware tracking that the remote
server uses for observability and incident detection.

Changed API errors (client.Gists.List, Get, Create, Edit) to use
ghErrors.NewGitHubAPIErrorResponse which properly:
- Records errors in the context for middleware access
- Preserves the response object for rate limit and status tracking
- Maintains consistency with other tools that use this pattern

This ensures production observability is maintained for Gist operations.

* chore: Update server.json schema to 2025-12-11

- Update schema URL to latest version (2025-12-11)
- Remove 'status' field (now managed by registry per 2025-09-29 changelog)

* fix(get_file_contents): Restore correct implementation from #1582

The refactor incorrectly restructured the GetFileContents logic:
- Move 'if rawOpts.SHA != "" { ref = rawOpts.SHA }' before GetContents call
- Always call GetContents first (not conditionally based on path suffix)
- Restore matchFiles helper function for proper fallback handling
- Use matchFiles when Contents API fails or raw API fails

This aligns with the improvements from PR #1582 that was merged into main.

* Rename registry to inventory in comments

Update remaining references to 'registry' in code comments to use
'inventory' consistently after the package rename.

---------

Co-authored-by: Adam Holt <4619+omgitsads@users.noreply.github.com>
Co-authored-by: Adam Holt <omgitsads@users.noreply.github.com>
Co-authored-by: Adam Holt <oholt@github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
 2025-12-17 09:56:24 +01:00
Tony Truong 5a4338c685 adding review comments grouped as threads (#1554)
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
License Check / license-check (push) Has been cancelled
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
Docker / build (push) Has been cancelled
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
GoReleaser Release / release (push) Has been cancelled
Publish to MCP Registry / publish (push) Has been cancelled
* adding review comments grouped as threads

* minor fix

* minor edit

* update docs

* fix docs

* increase limit to 100

* fixtext
 2025-12-15 12:59:53 +01:00
Tommaso Moro 94ee0745ca Add support for safe tool renaming (#1563) 
* add suppport for tool aliases for backwards compatibility when tool names change

* cleanup

* log alias usage as warning

* remove comments

* remove mock data

* remove unused code, move deprecated tool aliases to its own file

* remove unused code and add tests

* resolve tool aliases in its own explicit step

* improve logic by returning aliases used in resolvetoolaliases

* remove unused function

* remove comments

* remove comment

* Update pkg/github/deprecated_tool_aliases.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* restore comment

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-12-11 16:46:00 +00:00
Adam Holt 60aef5d2e3 Convert to modelcontextprotocol/go-sdk (#1428) 
Move from `mark3labs/mcp-go` to `modelcontextprotocol/go-sdk`.

This is mostly focused on updating tool schema and tool handler signatures, along with any associated internal changes related to those changes.

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: omgitsads <4619+omgitsads@users.noreply.github.com>
Co-authored-by: LuluBeatson <lulubeatson@github.com>
Co-authored-by: Lulu <59149422+LuluBeatson@users.noreply.github.com>
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
Co-authored-by: Sam Morrow <info@sam-morrow.com>
 2025-12-01 14:30:59 +01:00
Tommaso Moro 3e1fca0cc5 Tommy/tool-specific-config-support (#1394)
GoReleaser Release / release (push) Has been cancelled
License Check / license-check (push) Has been cancelled
Publish to MCP Registry / publish (push) Has been cancelled
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
Docker / build (push) Has been cancelled
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
* add enabledTools to StdioServerConfig

* add EnabledTools to MCPServerConfig, and logic to bypass toolset config if present

* add logic to register specific tools

* update readme

* Update to be consistent with: https://docs.google.com/document/d/1tOOBJ4y9xY61QVrO18ymuVt4SO9nV-z2B4ckaL2f9IU/edit?tab=t.0#heading=h.ffto4e5dwzlf

specifically
- allow for --tools and dynamic toolset mode together
- allow for --tools and --toolsets together

* go mod tidy

* update

* clean up comment

* fix

* fix

* updte

* update

* clean up
 2025-11-26 14:20:01 +00:00
JoannaaKL 28b868dad4 Add in memory cache for lockdown mode (#1416) 
* Apply lockdown mode to issues and pull requests

* Add cache

* Unlock in defer

* Add muesli/cache2go

* [WIP] Replace custom cache in lockdown.go with cache2go struct (#1425)

* Initial plan

* Replace custom cache with cache2go library

- Added github.com/muesli/cache2go dependency
- Replaced custom map-based cache with cache2go.CacheTable
- Removed manual timer management (scheduleExpiry, ensureEntry methods)
- Removed timer field from repoAccessCacheEntry struct
- Updated GetRepoAccessInfo to use cache2go's Value() and Add() methods
- Updated SetTTL to flush and re-add entries with new TTL
- Used unique cache names per instance to avoid test interference
- All existing tests pass with the new implementation

Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>

* Final verification complete

Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>

* Use muesli for cache

* Make RepoAccessCache a singleton (#1426)

* Initial plan

* Implement RepoAccessCache as a singleton pattern

Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>

* Complete singleton implementation and verification

Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>

* Remove cacheIDCounter as requested

Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>

* Update mutexes

* .

* Reuse cache

* .

* .

* Fix logic after vibe coding

* Update docs

* .

* Refactoring to make the code pretty

* Hide lockdown logic behind shouldFilter function

* .

* Tests

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
 2025-11-21 10:34:51 +01:00
Jonathan c73f06fa29 bumps google/go-github to v79 2025-11-15 22:07:38 +01:00
Tom Elliott e9033462e1 projects: serialization & pagination updates (#1390) 
* pagination, serialization updates

* projects: add server instructions (#1393)

* add server instructions

* Update instructions.go

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-11-14 11:25:35 +00:00