* enhance client support checks for MCP Apps UI rendering
* update dependencies and enhance MCP Apps UI support handling
* chore: regenerate license files
Auto-generated by license-check workflow
* retrigger CI
* update test
* introduce constants for client names and remove wrong ide name for mcp apps support
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
* feat: move copilot tools to default copilot toolset
Move AssignCopilotToIssue and RequestCopilotReview from the issues and
pull_requests toolsets respectively into a new default-enabled copilot
toolset. This groups all copilot-related tools together and makes them
available by default.
- Set Default: true on ToolsetMetadataCopilot
- Remove copilot from RemoteOnlyToolsets()
- Update AllTools() grouping and tests
- Regenerate docs
Refs: github/copilot-mcp-core#1180
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* refactor: move copilot tools to dedicated copilot.go
Extract AssignCopilotToIssue, RequestCopilotReview, AssignCodingAgentPrompt,
and all supporting types/helpers from issues.go and pullrequests.go into
copilot.go and copilot_test.go.
This follows the existing convention where each domain (actions, dependabot,
discussions, gists, etc.) has its own file, and keeps the copilot toolset
implementation cohesive in one place.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pin all three Dockerfile base images to their SHA256 digests to resolve
code scanning alerts for unpinned Docker images. Dependabot docker
ecosystem is already configured and will keep these digests up to date.
- node:20-alpine (alert #14)
- golang:1.25.7-alpine (alert #15)
- gcr.io/distroless/base-debian12 (proactive)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Add explicit detection of unmodified template text and placeholders
- Add detection of meaningless/spam-like titles
- Add 'Invalid' assessment category for spam/test issues
- Add label recommendations (waiting-for-reply, invalid)
- Strengthen 'Missing Details' criteria with specific examples
- Add guidance to be specific about which sections need actual content
This addresses issues like #2029 where template text was not replaced
with actual information but was not flagged as missing details.
* Add ProjectV2 status update tools (list, get, create)
Closes https://github.com/github/github-mcp-server/issues/1963
Add three new individual tools and wire them into the consolidated
project tools for managing GitHub ProjectV2 status updates:
- list_project_status_updates / projects_list: List status updates for
a project with pagination, ordered by creation date descending
- get_project_status_update / projects_get: Fetch a single status
update by node ID
- create_project_status_update / projects_write: Create a status update
with optional body, status, start_date, and target_date
New GraphQL types and queries (statusUpdateNode, statusUpdatesUserQuery,
statusUpdatesOrgQuery, statusUpdateNodeQuery) support both user-owned
and org-owned projects. The CreateProjectV2StatusUpdateInput type is
defined locally since the shurcooL/githubv4 library does not include it.
Also includes quality improvements discovered during implementation:
- Extract resolveProjectNodeID helper to deduplicate ~70 lines of
project ID resolution logic shared between addProjectItem and
createProjectStatusUpdate
- Add client-side YYYY-MM-DD date format validation for start_date
and target_date fields before sending to the API
- Fix brittle node type check in getProjectStatusUpdate that relied
on stringifying a githubv4.ID and comparing to "<nil>"
- Refactor createProjectStatusUpdate to accept typed parameters
instead of raw args map
- Add deprecated tool aliases for all three new individual tools
- Add ProjectResolveIDFailedError constant for consistent error
reporting
Test coverage includes 21 subtests covering both user and org paths,
pagination, error handling, input validation, field verification, and
consolidated tool dispatch.
* Fix projects_get required params and harden status update tools
Loosen projects_get schema to only require "method", since
get_project_status_update only needs status_update_id and never uses
owner or project_number. Also use pointer types for optional
statusUpdateNode fields, add owner_type validation for list/create
status updates, clamp negative per_page values, and fix
resolveProjectNodeID to return "" instead of nil on error.
* Resolve conflicts
* Update doc
* Update aliases
* Dont update tool renaming docs
---------
Co-authored-by: e-straight <elijahstr@users.noreply.github.com>
Co-authored-by: JoannaaKL <joannaakl@github.com>
CodeQL / Analyze (actions) (push) Has been cancelled
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
* Move scope storage into its own context key, separately from token info.
This allows us to provide scopes seperately in the remote server, where
we have scopes before we do the auth.
* Skip token extraction if token info already exists in context.
This is to avoid redundant token extraction in remote setup where token info may have already been extracted earlier in the request lifecycle.
* Check for existing scopes in context before fetching from GitHub API in scope challenge middleware
* Return error type for unknown tools in inventory builder and handle it in HTTP handler
tommaso-moro