Commit Graph

347 Commits

Author SHA1 Message Date
Matt Holloway a41d683a9b token extraction middleware 401 change
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
2026-01-30 12:26:30 +00:00
Matt Holloway a56a5b58a4 OAuth metadata implementation (#1862)
* initial oauth metadata implementation

* add nolint for GetEffectiveHostAndScheme

* remove CAPI reference

* remove nonsensical example URL

* anonymize

* add oauth tests

* replace custom protected resource metadata handler with our own

* remove unused header

* Update pkg/http/oauth/oauth.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* pass oauth config to mcp handler for token extraction

* chore: retrigger ci

* align types with base branch

* update more types

* initial oauth metadata implementation

* add nolint for GetEffectiveHostAndScheme

* remove CAPI reference

* remove nonsensical example URL

* anonymize

* add oauth tests

* replace custom protected resource metadata handler with our own

* Update pkg/http/oauth/oauth.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* chore: retrigger ci

* update more types

* remove CAPI specific header

* restore mcp path specific logic

* implement better resource path handling for OAuth server

* return auth handler to lib version

* rename to base-path flag

* switch to chi group

* make viper commands http only

* Default to http, but check for TLS in GetEffectiveHostAndScheme

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Adam Holt <me@adamholt.co.uk>
2026-01-30 12:51:49 +01:00
Roberto Nacu 2ac77d6af3 Fix feature flag checker and add insiders mode support (#1920)
* wip

* add insiders routes

* remove static checker param and clean up

* add tests for X-MCP-Features header parsing

* fix extractToolNames
2026-01-29 17:37:35 +01:00
Adam Holt bbaa877e56 Fix linter issues 2026-01-27 15:50:27 +01:00
Adam Holt 97e8f35dfd Merge branch 'main' into http-stack-2 2026-01-27 15:28:25 +01:00
Adam Holt c696607860 Move feature checker to stdio for now. A new one will be created later for the HTTP server. 2026-01-27 15:17:30 +01:00
Sam Morrow 47412e5c4b Refactor buffer processing for clarity and add edge case tests
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
Docker / build (push) Has been cancelled
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
GoReleaser Release / release (push) Has been cancelled
MCP Server Diff / mcp-diff (push) Has been cancelled
Publish to MCP Registry / publish (push) Has been cancelled
- Extract storeLine() and accumulate() helper closures to eliminate
  duplicated line processing and truncation logic
- Simplify main loop by using early return pattern (newlineIdx < 0 -> break)
- Add test for empty response body edge case
- Add test for exact maxLineSize boundary condition (10MB)

The refactored code reduces nesting and makes the flow clearer:
accumulate handles byte collection with truncation detection,
storeLine handles ring buffer storage with truncation markers.
2026-01-27 12:20:47 +01:00
Matt Holloway 4bb1ba9e85 consolidate buffer logic 2026-01-27 12:20:47 +01:00
Matt Holloway a1e82e78f6 add line length truncate buffer 2026-01-27 12:20:47 +01:00
Sam Morrow 40e21ec565 Fix generateInstructions to use only enabled toolsets
Previously, generateInstructions() iterated over AvailableToolsets() which
returns all toolsets that have tools defined, rather than only the enabled
toolsets based on WithToolsets() configuration.

This caused instructions for all toolsets to be included regardless of which
toolsets were actually enabled, leading to bloated instructions (e.g., 5886
chars vs 1226 chars when only 'repos' toolset is enabled).

Changes:
- Add EnabledToolsets() method to return only enabled toolset metadata
- Update generateInstructions() to use EnabledToolsets()
- Add regression test for the fix

Fixes #1897
2026-01-26 18:27:22 +01:00
Adam Holt 297dcfbbdd Add some request handler and header tests 2026-01-26 17:40:43 +01:00
Adam Holt d810e839dc Actually use the config that is passed 2026-01-26 17:00:02 +01:00
Roberto Nacu 1fad6c54ab Add lockdown mode support for HTTP server (#1876)
* add readonly and toolset support

* address feedback

* forgotten files

* remove redundant checks in WithRequestConfig

* move middleware in RegisterRoutes

* improve comment and add TestParseCommaSeparated

* fix broken TestInventoryFiltersForRequest

* parse X-MCP-Tools into ctx

* clean up TestInventoryFiltersForRequest

* review http args and add lockdown ctx helpers

* parse lockdown header and update GetFlags to retrieve ff from ctx

* clean up and fix tests

* fix GetFlags check, move lockdown parsing in WithRequestConfig and fix broken tests
2026-01-26 16:50:52 +01:00
tonytrg 7af51a079a adding correct insiders-mode name 2026-01-26 16:28:36 +01:00
Matt Holloway 60a8c21b8a remove old flags 2026-01-26 16:02:20 +01:00
Matt Holloway 0a62aabc94 default to consolidated actions/projects toolsets and add hold back flag 2026-01-26 15:07:38 +01:00
Roberto Nacu 8d25f46d3f Add readonly and toolset request handlers (#1858)
* add readonly and toolset support

* address feedback

* forgotten files

* remove redundant checks in WithRequestConfig

* move middleware in RegisterRoutes

* improve comment and add TestParseCommaSeparated

* fix broken TestInventoryFiltersForRequest

* parse X-MCP-Tools into ctx

* clean up TestInventoryFiltersForRequest

* Pass context to handler, but use request context for per-request data

* Pass through the context in MCP server creation functions

---------

Co-authored-by: Adam Holt <me@adamholt.co.uk>
2026-01-23 16:58:43 +01:00
Adam Holt f816f02d9f Merge branch 'main' into http-stack-2 2026-01-23 12:17:46 +01:00
Tommaso Moro 15e66b3df3 Generate server instructions in Inventory (#1869)
* carry over from https://github.com/github/github-mcp-server/pull/1863

* remove unused inv

* update toolsnap

---------

Co-authored-by: Sam Morrow <info@sam-morrow.com>
2026-01-23 09:57:47 +00:00
Sam Morrow 5e5ff27486 Address PR review feedback
- Extract dual-fetch logic into listProjectsFromBothOwnerTypes helper
- Rename addProjectItemWithResolution to addProjectItem (old function removed)
- Add GraphQL test coverage for add_project_item using githubv4mock
- Tests cover both org/issue and user/pull_request success paths
2026-01-22 23:27:21 +01:00
copilot-swe-agent[bot] eaaf1ea833 Update consolidated projects tools: make owner_type optional and fix add_project_item
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>

Fix tests and update toolsnaps for consolidated projects tools

Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
2026-01-22 23:27:21 +01:00
Adam Holt abffbf5f35 Add option to provide additional MCP server options via config 2026-01-20 12:33:05 +01:00
Adam Holt 740fbff6e6 Add a github server factory to HTTPMcpHandler to allow dependency injection in remote 2026-01-20 11:06:16 +01:00
JoannaaKL e81f120c1e Add tool search CLI (#1839)
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
Docker / build (push) Has been cancelled
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
GoReleaser Release / release (push) Has been cancelled
Publish to MCP Registry / publish (push) Has been cancelled
* Add tool search CLI

* Update comments

* Update docs

* Generate docs

* Dont document other commands

* Licenses

* chore: regenerate license files

Auto-generated by license-check workflow

* Try to unlock checks

* generate docs

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-01-19 15:59:40 +01:00
Adam Holt f13e75d8c3 Add API Host interface to resolve URLs dynamically 2026-01-19 14:44:19 +01:00
kerobbi 886025a96d add missing features.go 2026-01-19 12:15:08 +00:00
kerobbi d16f98b66d make headers parsing more robust, draft composite ff checker 2026-01-19 12:12:04 +00:00
kerobbi ad7a49a839 fix some linter errors, make port configurable 2026-01-19 11:58:39 +00:00
Sam Morrow a663a6b1f8 feat: add progress notifications during PR polling in assign_copilot_to_issue
Add MCP progress notifications during the PR polling loop to provide
real-time status updates while waiting for Copilot to create a PR.

Changes:
- Use the request parameter to access the ServerSession for notifications
- Send an initial progress notification when polling starts
- Send progress updates on each polling attempt with attempt count
- Only send notifications when progressToken is provided by the client

This aligns with the behavior in create_pull_request_with_copilot tool
and improves the user experience during the waiting period.
2026-01-16 11:37:26 +01:00
Sam Morrow f1d33d51f6 refactor: use GraphQLFeaturesTransport internally
Replace inline GraphQL-Features header logic in bearerAuthTransport with
the exported GraphQLFeaturesTransport. This removes code duplication and
ensures the transport is actually used, not just exported.
2026-01-16 11:37:26 +01:00
Sam Morrow d3ff0a2d07 fix: address review feedback
- Document GraphQLFeaturesTransport is for library consumers
- Convert githubv4.Int/String to native Go types in result map
- Remove misleading log comment since tool handlers lack logger access
2026-01-16 11:37:26 +01:00
Sam Morrow 92d8d51f08 fix: remove tool name reference from pending note message 2026-01-16 11:37:26 +01:00
Sam Morrow bece2b54cc fix: filter PRs by timestamp to avoid returning stale results
When polling for a linked PR after assigning Copilot to an issue,
we now capture the assignment time before the mutation and filter
to only return PRs created after that time. This prevents the tool
from incorrectly returning old PRs from previous Copilot assignments.
2026-01-16 11:37:26 +01:00
Sam Morrow 09adfc71ba feat: poll for linked PR after assigning Copilot to issue
Enhances the assign_copilot_to_issue tool to automatically poll for
the PR created by the Copilot coding agent after assignment.

Changes:
- Add findLinkedCopilotPR() to query issue timeline for CrossReferencedEvent
  items from PRs authored by copilot-swe-agent
- Add polling loop (9 attempts, 1s delay) matching remote server latency
- Return structured JSON with PR details when found, or helpful note otherwise
- Add PollConfig for configurable polling (used in tests to disable)
- Add GraphQLFeaturesTransport for feature flag header support

The returned response now includes:
- issue_number, issue_url, owner, repo
- pull_request object (if found during polling)
- Note with instructions to use get_copilot_job_status if PR not yet created
2026-01-16 11:37:26 +01:00
Tony Truong 3af1129c6b adding feature flag on dependency level (#1801)
* wip injecting ff function into tool as dep

* remove debug

* fix linter

* add better test

* adding compile time check

* move experimental to seperate config/ff value

* adding test var

* fixing test

* adding flag and possibility to call feature checker

* fixing name
2026-01-16 11:22:39 +01:00
copilot-swe-agent[bot] ccf519177e Fix dismiss_notification to accept HTTP 204 No Content response
- Add http.StatusNoContent (204) to the list of accepted success status codes
- Add test case for 204 response when marking notification as done
- Retain existing test for 200 response for backwards compatibility

Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
2026-01-16 11:16:11 +01:00
copilot-swe-agent[bot] d88eb83a4f Add custom_instructions parameter to assign_copilot_to_issue tool
- Added optional custom_instructions parameter to tool schema
- Updated implementation to pass custom instructions to agent assignment
- Added test case to verify custom_instructions works correctly
- Updated toolsnaps and documentation

The custom_instructions parameter allows users to provide additional
context, constraints, or guidance to the Copilot agent beyond what's
in the issue body, addressing the issue where additional context
would otherwise be lost.

Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
2026-01-15 18:09:34 +01:00
Tommaso Moro 19beb33c3f Bug fix: invalid tool should error out (#1776)
* get it working

* clean up approach by moving cleantools inside builder, this simplifies remote server too

* add tests for trimming and deduplication

* error out in the builder if there are unrecognized tools

---------

Co-authored-by: Sam Morrow <info@sam-morrow.com>
2026-01-15 17:37:06 +01:00
copilot-swe-agent[bot] 0bf791a4ce Regenerate toolsnaps with deterministic sorting
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
2026-01-15 17:33:22 +01:00
copilot-swe-agent[bot] 87a1110c15 Implement recursive JSON key sorting for toolsnaps
Sort all JSON object keys alphabetically at every level in toolsnaps by
unmarshaling and remarshaling. This leverages Go's built-in behavior where
json.Marshal automatically sorts map keys alphabetically, ensuring
consistent field ordering and eliminating noop churn in diffs.

Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
2026-01-15 16:15:39 +01:00
Adam Holt 61db07dba7 Remove extra config fields from HTTP server config 2026-01-15 12:09:49 +01:00
Adam Holt ed37e6f489 Move inventory creation to HTTP handler and add factory pattern. 2026-01-15 11:56:20 +01:00
Adam Holt db34a0c8d0 Fix the broken tests after our HTTP stack refactor 2026-01-14 13:00:48 +01:00
Adam Holt 32d2342318 Move http stuff into its own package 2026-01-14 12:50:49 +01:00
Adam Holt f3802d5607 Move lockdown to context 2026-01-13 18:22:11 +01:00
Adam Holt 3e30fc87cc Initial HTTP stack 2026-01-13 17:56:15 +01:00
copilot-swe-agent[bot] d18f26e559 Add GraphQL-Features header support for agent assignment API
- Add context-based GraphQL feature flag support
- Modify bearerAuthTransport to read features from context and add GraphQL-Features header
- Use issues_copilot_assignment_api_support feature flag for updateIssue mutation
- Export GetGraphQLFeatures function for use in HTTP transport layer

This allows the assign_copilot_to_issue tool to work with the non-GA agent assignment API
by sending the required GraphQL-Features header.

Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
2026-01-12 15:45:58 +01:00
copilot-swe-agent[bot] 88d117bd82 Add base_ref support to assign_copilot_to_issue tool
- Add optional base_ref parameter to tool schema
- Change from replaceActorsForAssignable to updateIssue mutation with agentAssignment
- Add AgentAssignmentInput and UpdateIssueInput structs for new GraphQL mutation
- Update all tests to use new mutation structure
- Add test case for base_ref functionality
- Update toolsnaps and documentation

Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
2026-01-12 15:45:58 +01:00
Sam Morrow c44ce2e2b8 chore: remove unused filterResourcesByURI function
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
Docker / build (push) Has been cancelled
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
GoReleaser Release / release (push) Has been cancelled
Publish to MCP Registry / publish (push) Has been cancelled
2026-01-12 14:19:11 +01:00
Sam Morrow 53a672040f fix: keep all resources registered for resources/read requests
The ForMCPRequest optimization was incorrectly filtering resources by
doing an exact string match between the URI template pattern and the
concrete URI. This would never match because templates like
'repo://{owner}/{repo}/contents{/path*}' don't match concrete URIs
like 'repo://owner/repo/contents/file.py'.

Instead of implementing template matching in the inventory, we simply
keep all resources registered for resources/read requests and let the
SDK handle URI template matching internally (which it already does
correctly via uritemplate.Regexp().MatchString()).

This fixes resources/read returning 'Resource not found' for valid URIs.
2026-01-12 14:19:11 +01:00