CodeQL / Analyze (actions) (push) Has been cancelled
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
Tools that return user generated content should have open world hints,
to allow clients to inform users that the content may be untrusted and
prompt them to approve the request before executing it.
The CodeQL workflow requires security-events write permission and access
to internal GitHub registries/packs that aren't available in forks.
Adding a condition to only run on the main repository prevents workflow
failures in forked repositories.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Replace string conversions with mcp.IconThemeLight and mcp.IconThemeDark
constants to match the SDK's typed IconTheme field. This fixes the CI build
errors where string literals were being used instead of the proper IconTheme type.
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
- Use separate -m flags for multi-line git commit message
- Add proper indentation to template literal content to fix YAML parsing
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
* fix: handle architecture-specific license differences
The licenses script now:
- Generates separate license reports per GOOS/GOARCH combination
- Groups identical reports together (comma-separated arch names)
- Adds a Table of Contents at the top of each platform file
- Handles cases where different architectures have different dependencies
(e.g., x/sys/unix vs x/sys/windows, mousetrap on Windows only)
This addresses the issue discovered in cli/cli where some deps changed
which changed the mod graph for different GOARCH and affected the
exported licenses because go-licenses tries to find common ancestors.
* fix: make license script portable and deterministic
Address review feedback:
- Remove bash 4.0+ associative array requirement for macOS compatibility
- Add cross-platform hash function (md5sum on Linux, md5 on macOS)
- Ensure deterministic iteration order using sorted groups file
- Add better error handling for failed go-licenses commands
- Fix grammar: 'architecture(s)' -> 'architectures'
- Add documentation for third-party/ being a union of all architectures
- Use file-based state instead of associative arrays for portability
* fix: update licenses-check to use new architecture-aware format
- Check now regenerates using ./script/licenses and compares
- Add GOROOT/PATH setup in CI to fix go-licenses module info errors
- Check both license files AND third-party directory for changes
- See: https://github.com/google/go-licenses/issues/244
* fix: use LC_ALL=C for consistent sorting across systems
The sort command uses locale-specific ordering which can differ between
systems. Use LC_ALL=C to ensure consistent ordering in CI and locally.
* feat: auto-fix license files on PRs and improve CI reliability
Changes:
- Pin go-licenses version in CI for reproducibility (commit 5348b744)
- Add GOROOT/PATH setup for 'Package does not have module info' fix
- Update license-check.yml to auto-fix and push to PR branches
- Add CI=true env var to use pinned go-licenses version
- Add dependabot exclusion from auto-fix workflow
- Add code-scanning exclusion for third-party files
* feat: auto-close PRs that only needed license updates
After the bot pushes license fixes, check if the PR now only contains
license file changes. If so, close it automatically with a comment
explaining that the license updates are complete.
This prevents stale PRs from accumulating when someone creates a PR
just to fix licenses, or when all other changes were already merged
to the base branch.
* feat: auto-create/manage license fix PRs for failing PRs
Creates stacked PRs to fix license issues:
- Detects when a PR needs license updates
- Creates child PR: main <- PR:feature <- PR:license-fix
- Tracks PRs with metadata and hash of license changes
- Auto-closes if user fixes licenses manually
- Auto-closes and recreates if dependencies change
- Prevents multiple fix PRs for same base PR
Rules:
- Only targets PRs against main (not stacked PRs)
- Only runs on ready-for-review PRs (not drafts)
- Skips bots and forks
- Hash-based detection avoids unnecessary work
* fix: allow auto-fix workflow to run on dependabot PRs
Dependabot PRs frequently need license updates and can't be merged until
fixed. The auto-fix workflow helps by creating a child PR with the
license changes, making it easy to merge both together.
* fix: address Copilot review comments
- Remove dependabot exclusion (we want to support dependabot PRs)
- Comment indentation already fixed
- CI env var already set for reproducibility
* refactor: move base branch filter to on: block
Moved the 'targets main' check from job if: to workflow on.pull_request.branches.
This prevents the workflow from even triggering for PRs targeting other branches,
saving CI resources.
Draft check is implicit in the types list (opened + ready_for_review).
Fork check must stay in if: condition (can't be filtered in on: block).
* refactor: merge auto-fix into license-check workflow
Combines both workflows into one with two jobs:
1. license-check: Checks licenses, fails if needed, sets outputs
2. auto-create-fix-pr: Creates child PR if needed (only for non-forks)
Benefits:
- Single workflow file, easier to maintain
- Check fails (blocks merge) while still creating helpful fix PR
- Fork detection in first job, second job skips for forks
- Hash-based tracking prevents duplicate PRs
* refactor: simplify license-check to auto-commit approach
Much simpler workflow:
1. Always try to auto-commit fix directly to PR branch
2. If push fails (fork without permissions), comment once with instructions
3. Don't create child PRs - just fix in place or give instructions
4. Only comment if not already commented (prevent spam)
5. Always fail check if licenses need updating
Benefits:
- Much simpler - single job
- No child PR management complexity
- Clear UX: either fixed or instructed
- Works for all PRs (internal/fork/dependabot)
Add DestructiveHint: true to the delete_project_item tool to be
consistent with other delete operations (delete_file and
delete_workflow_run_logs) that properly indicate destructive behavior.
This helps LLMs better understand that this tool permanently removes
data and should be used with appropriate caution.
Co-Authored-By: Claude <noreply@anthropic.com>
* Add raw client error annotation and annotate GetFileContents
* Track response.
* add raw errors to context
* add raw api error test
* Update pkg/errors/error.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add blank line after Error() method for readability
* add NewGitHubRawAPIErrorResponse back
---------
Co-authored-by: Matt Holloway <mattdholloway@pm.me>
Co-authored-by: Matt Holloway <mattdholloway@github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
CodeQL / Analyze (actions) (push) Has been cancelled
Docker / build (push) Has been cancelled
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
GoReleaser Release / release (push) Has been cancelled
License Check / license-check (push) Has been cancelled
Publish to MCP Registry / publish (push) Has been cancelled
The issue was that after PR #1640 switched from closure-based deps to context-based deps,
the stdio server was missing middleware to inject ToolDependencies into the request context.
This caused tools to panic with "ToolDependencies not found in context" when called.
Added middleware in NewMCPServer() that wraps all requests with github.ContextWithDeps(),
ensuring deps are available to tool handlers via MustDepsFromContext().
Also added tests to verify server creation and toolset resolution logic.
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
GoReleaser Release / release (push) Has been cancelled
License Check / license-check (push) Has been cancelled
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
Docker / build (push) Has been cancelled
Publish to MCP Registry / publish (push) Has been cancelled
- Remove Sizes field from octicons.Icons() to fix compatibility with older MCP clients
- Older clients like Cursor expect sizes to be a string, not an array
- The 2025-11-25 MCP spec changed sizes from string to array
- Omitting the optional Sizes field makes icons compatible with all clients
- Update tests and toolsnaps to reflect the change
Fixes#1644
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
This refactor addresses performance issues in per-request server scenarios
where creating ~90 handler closures per request was causing latency.
Changes:
- Add ContextWithDeps, DepsFromContext, MustDepsFromContext to dependencies.go
- Add NewServerToolWithContextHandler, NewServerToolWithRawContextHandler to inventory
- Convert all 89 tool handlers from closure pattern to direct context-based deps
- Update all tests to inject deps into context before calling handlers
- Mark old NewServerTool and NewServerToolFromHandler as deprecated
The new pattern:
- Before: func(deps) handler { return func(ctx, req, args) { use deps } }
- After: func(ctx, deps, req, args) { use deps }
Dependencies are now injected into context once (via ContextWithDeps) and
extracted by NewTool internally before passing to handlers. This eliminates
closure creation on the hot path for remote servers.
* Upgrade MCP Go SDK to v1.2.0-pre.1 and add Octicon icons to tools
- Upgrade MCP Go SDK from v1.1.0 to v1.2.0-pre.1 for Icon support
- Add Icon field to ToolsetMetadata for Octicon name assignment
- Add OcticonURL() helper to generate CDN URLs for Octicon SVGs
- Add Icons() method on ToolsetMetadata to generate MCP Icon objects
- Apply icons automatically in RegisterFunc when tool is registered
- Add icons to all 22 toolset metadata constants with appropriate Octicons
- Update server.go to use new Capabilities API (fixes deprecation warnings)
This demonstrates how the toolsets refactor makes adding new features simpler:
icons are defined once in ToolsetMetadata and automatically applied to all
tools in that toolset during registration.
* Update third-party licenses for SDK upgrade
* Address review feedback: enum size validation, mutation fix, tests
- Replace runtime size validation with compile-time enum type (Size with SizeSM=16, SizeLG=24)
- Fix RegisterFunc mutation by making shallow copy of tool before modifying Icons
- Add comprehensive tests for octicons package (URL, Icons, Size constants)
- Add toolsets tests for ToolsetMetadata.Icons(), RegisterFunc mutation prevention,
and existing icon preservation
- Improve icon choices for better visual semantics:
- actions: play → workflow (more specific to GitHub Actions)
- secret_protection: key → shield-lock (better represents protection)
- gists: code → logo-gist (dedicated gist icon exists)
* Add GitHub mark icon to server metadata
Add the mark-github octicon to the server's Implementation struct
so that MCP clients can display the GitHub logo for this server.
The icon is provided in both 16x16 and 24x24 SVG sizes.
* Fix rebase conflicts: use Registry methods and NullTranslationHelper
- Remove duplicate old toolsets functions (AvailableToolsets, GetValidToolsetIDs, GetDefaultToolsetIDs)
- Use Registry.AvailableToolsets() and Registry.HasToolset() instead
- Replace stubTranslator with translations.NullTranslationHelper
- Use new SDK Capabilities struct instead of deprecated HasTools/HasResources/HasPrompts
- Add icon-related tests to registry_test.go
* Use embedded data URIs for Octicon icons
- Embed SVG icons using go:embed for offline use and faster loading
- Convert icons to base64 data URIs at runtime
- Fall back to CDN URL for non-embedded icons
- Add test to verify all toolset icons are properly embedded
- 44 SVG files (22 icons × 2 sizes) totaling ~27KB
* Convert icons from SVG to PNG for MCP client compatibility
MCP clients don't support SVG data URIs, so convert all embedded icons
to PNG format using rsvg-convert.
Changes:
- Convert all 44 SVG icons to PNG format
- Add 8 new icons: copilot, git-merge, repo-forked, star-fill
- Update octicons.go to use PNG MIME type
- Add script/fetch-icons for easy icon management
- Update tests and toolsnaps for PNG format
* Add mark-github icon for server metadata
* Add light/dark theme icons for tools, resources, and prompts
- Switch from size-based (16/24px) to theme-based (light/dark) icons
- Use only 16x16 icons for smaller bundle size
- Generate white (inverted) icons for dark theme backgrounds
- Add icons to resources and prompts (auto-applied from toolset metadata)
- Add 'file' icon for repository content resources
- Update fetch-icons script to generate both theme variants
* Use 24px icons with SVG fill modification for themes
- Switch from 16px to 24px icons for better visibility
- Use SVG fill attribute (#24292f for light, #ffffff for dark) instead
of ImageMagick color inversion for cleaner theme variants
- Remove ImageMagick dependency from fetch-icons script
* Add specific icons for each repository resource type
- repository_content: repo icon
- repository_content_branch: git-branch icon
- repository_content_commit: git-commit icon (new)
- repository_content_tag: tag icon
- repository_content_pr: git-pull-request icon
Resources now have explicit icons set rather than relying on toolset fallback.
* fix: restore Icon fields to toolset metadata and add icons to docs
- Add Icon field to all ToolsetMetadata definitions (lost during rebase conflict resolution)
- Update doc generator to include Octicon icons in toolsets table
- Update doc generator to include icons in tool section headers
- Use Primer Octicons CDN for GitHub markdown compatibility
* feat: add icons to individual tools in documentation
* fix: use repo-local icons with picture element for GitHub theme support
- Reference icons from pkg/octicons/icons/ instead of external CDN
- Use picture element with prefers-color-scheme for light/dark mode
- GitHub markdown renderer will display these correctly
* fix: remove redundant icons from individual tools
Icons are kept on section headers and toolsets table only - having the same
icon on every tool within a section was visually noisy and redundant.
* Add icons to remote server toolsets documentation
* Fix icon paths for docs/remote-server.md
* Add remote-only toolsets with auto-generated documentation and icons guide
- Add ToolsetMetadataCopilot, ToolsetMetadataCopilotSpaces, ToolsetMetadataSupportSearch
- Add RemoteOnlyToolsets() function to return remote-only toolset metadata
- Update doc generator to auto-generate remote-only toolsets table with icons
- Create docs/toolsets-and-icons.md explaining how to add icons to toolsets
- Add link to icons guide in CONTRIBUTING.md
* Add icon validation tests and single source of truth for required icons
- Add pkg/octicons/required_icons.txt as single source of truth for icons
- Add RequiredIcons() function to read the required icons list
- Update script/fetch-icons to read from required_icons.txt
- Update octicons_test.go to use RequiredIcons() instead of hardcoded list
- Add pkg/github/toolset_icons_test.go with:
- TestAllToolsetIconsExist: validates all toolset icons are embedded
- TestToolsetMetadataHasIcons: ensures all toolsets have icons set
- Add 'book' icon for SupportSearch toolset
- Update docs/toolsets-and-icons.md with fetch-icons and CI validation docs
* fix: remove unused icon parameter from writeToolDoc
- Remove unused 'icon' parameter from writeToolDoc function signature
- Fix whitespace inconsistency in octicons_test.go
- Fixes lint failure: unused-parameter revive error
* fix: combine icon with name column in remote docs for proper table rendering
- Move icon from separate column to Name column with <br> separator
- Keep <picture> element for light/dark theme support
- Remove empty icon column that was collapsing to zero width
- Remove unused octiconSimpleImg function
Add NewGitHubAPIStatusErrorResponse helper function to properly track
GitHub API errors when the API call succeeds but returns an unexpected
HTTP status code (e.g., 404, 422, 500).
Previously, these errors were returned via utils.NewToolResultError which
bypasses the context-based error tracking used by the remote server's
error_categorizer.go for observability metrics. This resulted in 100%
tool call success rates in observability even when errors occurred.
The fix adds a new helper function that:
1. Creates a synthetic error from the status code and response body
2. Records the error in context via NewGitHubAPIErrorResponse
3. Returns the MCP error result to the client
Updated all tool files to use the new pattern for status code errors:
- pullrequests.go: 12 fixes
- repositories.go: 18 fixes
- issues.go: 10 fixes
- notifications.go: 6 fixes
- projects.go: 5 fixes
- search.go: 3 fixes
- search_utils.go: 1 fix
- gists.go: 4 fixes
- code_scanning.go: 2 fixes
- dependabot.go: 2 fixes
- secret_scanning.go: 2 fixes
- security_advisories.go: 4 fixes
Total: ~69 error paths now properly tracked.
Note: Parameter validation errors (RequiredParam failures) and internal
I/O errors (io.ReadAll failures) intentionally continue to use
utils.NewToolResultError as they are not GitHub API errors.
Adam Holt