Move from the v1.7.0-pre.3 pre-release to the final v1.7.0 release, which
consolidates the pre-releases with no further changes. Regenerate the
third-party license files to reflect the new version tag.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 95b8432c-f280-472e-a242-d3ca6dc31f19
* build: require Go 1.25.12
Ensure setup-go and GoReleaser use the patched Go toolchain for release binaries.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 0b2aa497-b47d-464a-b132-af0dcaf2b621
* build(ui): update fast-uri to 3.1.4
Resolve the high-severity host-confusion advisories reported by npm audit.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 0b2aa497-b47d-464a-b132-af0dcaf2b621
---------
Co-authored-by: Ross Tarrant <rosstarrant@github.com>
Adopt the pre.3 protocol correctness fixes without changing server wiring or MCP tool schemas. Update exact SDK license references for all release platforms.
Copilot-Session: f399f533-3d1f-4c76-872b-f9813729a61f
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The go-sdk 1.7.0-pre.2 bump defaults to MCP protocol 2026-07-28, which per
SEP-2322 forbids the server from initiating JSON-RPC requests (including
`elicitation/create`) while serving a request. The OAuth login flow presents
the authorization prompt via `ServerSession.Elicit`, so on 2026-07-28 sessions
it now errors ("cannot be sent while serving a request ... return an
InputRequests map instead"), which broke TestSessionPrompterPromptActions and
would break real 2026-07-28 clients (stdio included, since server/discover is
transport-agnostic).
Migrate the OAuth middleware to multi-round-trip requests (MRTR) while keeping
pre-2026-07-28 clients unchanged:
- Legacy clients (< 2026-07-28) keep presenting the prompt via server-initiated
elicitation exactly as before.
- Modern clients (>= 2026-07-28) receive the authorization prompt as an
`InputRequests` elicitation returned from the tool call; the client fulfills
it and retries, and the middleware then awaits the token and proceeds. This
keeps the authorization URL out of the model context.
oauth.Manager gains AwaitToken (resume half of MRTR) and Cancel (tear down on
decline). Tests cover the accept/decline/no-capability MRTR paths and assert
that server-initiated elicitation is reported undeliverable on 2026-07-28.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 18e70efa-1b2d-4290-ba51-b82998db4ff8
* chore(deps): bump go-github v87 -> v89 and resolve breaking changes
Bumps google/go-github from v87 to v89 across the module and fixes the
resulting breaking changes. No tool or behavior changes.
- Rewrite all import paths go-github/v87 -> go-github/v89.
- gists.go: Gists.Create now takes CreateGistRequest by value and
Gists.Edit is renamed to Gists.Update taking UpdateGistRequest.
- repositories_test.go: adapt to RepositoryRelease fields that became
value types in v89 (ID, TagName, Draft).
- Regenerate third-party license files for the new module path.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Don't clear gist description on update when omitted
update_gist always sent Description as a pointer to the OptionalParam
zero value (""), so omitting description would overwrite an existing gist
description with an empty string. Only set UpdateGistRequest.Description
when the caller actually provided the argument; an explicit empty string
still clears it. Adds a test asserting the description key is absent from
the PATCH body when omitted and present when set.
This addresses a pre-existing behavior surfaced while migrating to the
v89 gist request types.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* chore(deps): upgrade go-sdk to v1.7.0-pre.1 (new MCP spec)
Bumps github.com/modelcontextprotocol/go-sdk v1.6.1 -> v1.7.0-pre.1, the
pre-release that implements the new stateless MCP spec (SEP-2575 server/discover,
SEP-2567 sessionless, MRTR per SEP-2322).
The only source-visible change is tool annotation serialization: the new SDK
drops `omitempty` on ToolAnnotations.ReadOnlyHint and IdempotentHint, so false
values are now emitted explicitly. Regenerated the 113 affected toolsnaps to
match. No behavioural changes; build, vet, test and lint all pass.
Refs: github/copilot-mcp-core#1709
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* chore: regenerate license files
Auto-generated by license-check workflow
* ci(mcp-diff): pin to cross-spec-aware mcp-server-diff (3c2d5ea)
Pins both the stdio and streamable-http MCP Server Diff jobs to the 3.0
branch of SamMorrowDrums/mcp-server-diff (commit 3c2d5ea), which normalizes
cross-spec-version churn: _meta protocol plumbing, CacheableResult cache
hints, the initialize envelope, and tool-annotation default hints. Without it
the go-sdk v1.6.1 -> v1.7.0-pre.1 bump would surface ~113 spurious
idempotentHint/readOnlyHint:false diffs from the SDK dropping omitempty.
Temporary commit pin; move to the v3.0.0 tag once it ships.
Refs: github/copilot-mcp-core#1709
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* ci(mcp-diff): bump to a2ba618 (stateless server/discover probe)
a2ba618 adds the SEP-2575 server/discover stateless probe path, so each
server is probed at its own newest supported spec (base v1.6.1 via
initialize/2025-11-25, this branch via server/discover/2026-07-28) rather
than negotiating both down to the legacy handshake. Produces an honest,
signal-only cross-spec diff. Still a temporary commit pin; moves to v3.0.0
once tagged.
Refs: github/copilot-mcp-core#1709
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* ci(mcp-diff): use full commit SHA for action pin
Actions rejects shortened SHAs ('not supported'); use the full
a2ba618c42293fb36e67be88e59c60d5608a302a so the action resolves.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* ci(mcp-diff): track 3.0 HEAD (8fc26d8, becomes v3.0.0)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* feat(inventory): project owner/repo to Mcp-Param-* headers (SEP-2243)
Annotates owner/repo tool params with x-mcp-header so the SDK projects them
to Mcp-Param-owner/Mcp-Param-repo request headers. A remote proxy can route
and filter on owner/repo from headers instead of re-parsing the JSON-RPC body
(headers are SDK-validated against the body). No-op for tools without these
params; old-protocol traffic unaffected.
Refs: github/copilot-mcp-core#1709, #1828
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(inventory): preserve instructions in ForMCPRequest incl. server/discover
ForMCPRequest dropped the generated instructions when narrowing the per-request
inventory, so HTTP server/discover (and initialize) returned empty instructions
even though the full inventory had them. Preserve instructions on the copy and
treat server/discover like initialize. Fixes discover<->initialize parity flagged
on go-sdk#1034 (root cause was here, not the SDK).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* ci(mcp-diff): pin to mcp-server-diff v3.0.0
Release is out; move both jobs from the 3.0-branch SHA to v3.0.0
(3521651, full SHA since Actions rejects short SHAs).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* test(github): enforce owner/repo header projection across all tools
Export HeaderParams + AnnotateHeaderParams and add a coverage test over the
full all-toolsets inventory asserting every owner/repo param projects to its
Mcp-Param-* header. Guards the remote proxy's per-request header read so a new
tool can never silently ship without it (would fall back to body re-parsing).
Adding a future routing param is one entry in inventory.HeaderParams.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(inventory): clone schema before header annotation to avoid shared-map race
AnnotateHeaderParams mutated the *jsonschema.Schema (and per-property Extra
maps) shared with the original tool definition via the caller's shallow copy.
Under per-request registration (remote server), concurrent requests could race
on — and fatally panic from — the same Extra map. Now clone only what we touch
(schema value, Properties map, annotated property schemas + their Extra maps);
the original is never written. Adds a no-mutation test and a 64-goroutine
race regression (go test -race clean).
Addresses Copilot review on #2787.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
* feat(oauth): add stdio OAuth 2.1 stdio login
Introduce internal/oauth, a self-contained library that performs the
user-facing GitHub OAuth login the stdio server uses to obtain a token
without a pre-provisioned PAT. It is independent of MCP: client concerns
(elicitation) sit behind the Prompter interface so the flows are testable
without a live session.
What it provides:
- Authorization-code + PKCE flow with a local loopback callback server,
state/CSRF validation, and XSS-safe result pages.
- Device-authorization flow as a fallback (headless, containers).
- A Manager that selects the most secure available channel
(browser auto-open -> URL elicitation -> last-resort user action),
runs a single flow at a time, and exposes a refreshing token source.
Both GitHub OAuth Apps and GitHub Apps are supported without special
casing: the token is modeled as an x/oauth2 refreshing TokenSource, so
expiring GitHub App user tokens are renewed transparently (the gap that
made a stored-token approach silently die after ~8h).
When a client lacks secure URL elicitation and the flow falls back to a
tool-response message, the message advises the user that their agent/CLI/
IDE does not appear to support URL elicitation and suggests requesting it
for improved security.
Tests exercise real protocol behavior against an httptest GitHub stand-in:
PKCE challenge/verifier, GitHub App refresh-on-expiry, device polling,
URL elicitation, declined prompts, the last-resort action with advisory,
and single-flight concurrency.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(oauth): reap browser launcher and keep native callback on loopback
Address code review:
- openBrowser: reap the launcher process asynchronously so it does not
linger as a zombie for the lifetime of the server.
- listenCallback: take an explicit bindAll flag and bind to all interfaces
only inside a container (where the published port arrives via eth0).
A native run, even with a fixed callback port, now stays on 127.0.0.1
instead of 0.0.0.0.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(oauth): fail fast when a fixed callback port is unavailable
A fixed --oauth-callback-port is registered with the OAuth app and chosen
deliberately, so a bind failure means another process holds the port and
could intercept the authorization redirect. Treat that as fatal instead of
silently downgrading to the device flow, which would mask the conflict.
Also warn, when binding the callback inside a container, that the listener
is on all interfaces and should be published to loopback only so the
authorization code is not exposed on the container network.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(oauth): surface refresh failures, bound refresh, prefer device flow when headless
Addresses pre-merge review of the OAuth stdio core:
- Log a one-time warning when token refresh fails instead of silently
returning an empty access token, so a forced re-login isn't a surprise.
- Bound each background token refresh with a 30s HTTP client timeout so a
stalled GitHub token endpoint can't block tool calls indefinitely.
- On a headless host (no display server) with a random callback port, fall
back to the device-code flow — the only channel reachable from a browser
on another machine — instead of dead-ending on an unreachable localhost
redirect. A generic browser-open failure still offers the manual URL.
- Mark the callback bind failure with a sentinel so the fixed-port-busy
fatal path can't misreport an unrelated error as a port conflict.
- Export NormalizeHost so callers can recognize the default github.com host
(consumed by the build-time baked-in credential guard).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* feat(oauth): wire stdio OAuth 2.1 login into the server (2/4) (#2710)
* feat(oauth): wire stdio OAuth 2.1 login into the server
Connect the internal/oauth core library to the stdio MCP server so users
can authenticate with an OAuth App or GitHub App client ID instead of a
static personal access token.
- BearerAuthTransport gains a TokenProvider that is consulted per request,
letting the lazily-acquired, auto-refreshing OAuth token take effect
without rebuilding the client.
- createGitHubClients uses BearerAuthTransport (and skips go-github's
WithAuthToken, which would pin a static token) when a TokenProvider is set.
- RunStdioServer starts without a token and installs receiving middleware
that runs the authorization flow on the first tool call, surfacing the
auth URL or device code via elicitation (or a tool result as a fallback).
- Tool filtering uses the requested OAuth scopes; the default supported set
hides nothing, while a narrower --oauth-scopes both narrows the grant and
filters tools accordingly.
- A sessionPrompter adapts the MCP server session to oauth.Prompter, keeping
the authorization URL off the model's context.
- New stdio flags: --oauth-client-id/-client-secret/-scopes/-callback-port.
This is stdio-only and deliberately does not touch MCP-HTTP auth.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* refactor(oauth): address review — omit empty bearer header, guard token/oauth
- BearerAuthTransport omits the Authorization header entirely when the token
is empty (pre-authorization) rather than sending an empty "Bearer " value.
- RunStdioServer rejects the ambiguous combination of a static Token and an
OAuthManager up front, enforcing the documented mutual exclusivity.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* docs(oauth): clarify SupportedScopes is the stdio default and tool filter
Document that stdio OAuth login requests these scopes by default and then
filters the exposed tools to the scopes actually granted, so a tool whose
required scope is absent from this list is hidden under default OAuth even
though a PAT carrying that scope would expose it. Keep the list in sync with
tool scope requirements when scopes change.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Distinguish undeliverable auth prompts from user declines
An elicitation prompt that the client cannot deliver (a transport or
protocol failure) was treated the same as a user actively declining: any
display error cancelled the flow. That conflated a system failure with a
deliberate "no", so a client that advertised URL elicitation but failed
to deliver it would hard-fail the login instead of degrading.
Add an ErrPromptUnavailable sentinel alongside ErrPromptDeclined and have
the MCP adapter return it when Elicit fails at the transport level. The
manager now falls back to the manual user-action channel on an
undeliverable prompt (keeping the background flow alive so the user can
still authorize out of band), while a genuine decline still aborts. A
context-cancelled prompt is checked first so an ending flow is never
misread as a transport failure.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* build(oauth): bake in default OAuth credentials for official releases (3/4) (#2711)
* build(oauth): bake in default OAuth credentials via build-time ldflags
Inject the public OAuth client credentials (stored as the OAUTH_CLIENT_ID
and OAUTH_CLIENT_SECRET repo secrets) at build time via -ldflags so
official binaries and images ship a working default app for zero-config
login. Security relies on PKCE, not on the secret. Local/dev builds leave
the values empty and continue to require an explicit token or
--oauth-client-id.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(oauth): recognize github.com host aliases for the baked-in client
Match the default host via oauth.NormalizeHost instead of only an empty
host string, so an explicit GITHUB_HOST=github.com (or api.github.com)
still counts as the default and keeps zero-config baked-in login working.
GHES and ghe.com users continue to bring their own --oauth-client-id.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* docs(oauth): document stdio OAuth login; make PAT optional in install config (#2717)
Add a dedicated Local Server OAuth Login guide (docs/oauth-login.md) covering
the PKCE/device flows, display channels and the URL-elicitation security
advisory, scope-based tool filtering, the fixed-port Docker recipe and its
loopback/port-safety behavior, bringing your own OAuth or GitHub App, and the
GitHub Enterprise Server / ghe.com requirement to register an app on that host
(custom --gh-host directs login at that instance's authorization server).
Reflect that the local server now logs in with OAuth by default on github.com:
- README: make the stdio Docker install badges OAuth-first (fixed callback port
8085 published to loopback), drop the PAT prompt, and reframe the PAT as an
optional alternative with a pointer to the new guide.
- server.json: make GITHUB_PERSONAL_ACCESS_TOKEN optional and publish the OAuth
callback port so the registry default works without a token.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Bumps github.com/modelcontextprotocol/go-sdk from v1.6.0 to v1.6.1 and
removes the CrossOriginProtection bypass we previously installed on the
StreamableHTTP handler.
As of go-sdk v1.6.0 the cross-origin check is opt-in: a nil
CrossOriginProtection on StreamableHTTPOptions means no check is run.
v1.6.1 also marks the field itself as deprecated (the SDK recommends
wrapping the handler with middleware instead, and the field will be
removed in v1.8.0).
This server authenticates via bearer tokens, not cookies, so the
Sec-Fetch-Site CSRF check is unnecessary and would block browser-based
MCP clients. Leaving CrossOriginProtection unset preserves that
behavior without depending on a deprecated API.
Supersedes #2541.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Breaking changes addressed:
- raw.NewClient: Use WithHTTPClient/WithEnterpriseURLs options, pass ctx to
NewRequest, return (*Client, error)
- internal/ghmcp/server.go: Use functional options for REST client creation,
replace UserAgent field mutation with UserAgentTransport wrapper, add
restUATransp field to githubClients struct
- pkg/github/dependencies.go: Use functional options for REST client creation,
handle raw.NewClient error return
- pkg/github/actions.go: Handle new WorkflowDispatchRunDetails return value
from CreateWorkflowDispatchEventByID/ByFileName
- pkg/github/issues.go: Replace IssueListOptions with ListOptions for
SubIssue.ListByIssue
- pkg/github/notifications.go: MarkThreadDone now takes string instead of
int64; remove ParseInt and strconv import
- pkg/github/projects.go: Remove pointer indirection from
ListProjectsPaginationOptions and ListProjectsOptions fields
- pkg/github/issues_granular.go: Pass ctx to NewRequest, remove ctx from Do
- Test files: Add mustNewGHClient helper, replace all NewClient calls,
fix stubClientFnFromHTTP signature, fix lockdown_test.go BaseURL handling,
fix raw_test.go, remove invalid threadID test case
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Upgrades github.com/modelcontextprotocol/go-sdk from v1.5.0 to
v1.5.1-0.20260403154220-27f29c1cef3b which includes proper media type
parsing for Content-Type headers, fixing the strict string matching
that rejected application/json; charset=utf-8.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Upgrade the MCP Go SDK from v1.3.1-0.20260220105450-b17143f71798
(pseudo-version) to v1.5.0 (latest stable).
This also resolves#2333, as the SDK now correctly handles
Content-Type headers with MIME parameters (e.g. charset=utf-8)
via mime.ParseMediaType in StreamableHTTPHandler (added in v1.4.1).
Transitive dependency updates:
- go directive: 1.24.0 → 1.25.0 (required by SDK)
- golang.org/x/oauth2: v0.34.0 → v0.35.0
- golang.org/x/sys: v0.40.0 → v0.41.0
- segmentio/encoding: v0.5.3 → v0.5.4
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* enhance client support checks for MCP Apps UI rendering
* update dependencies and enhance MCP Apps UI support handling
* chore: regenerate license files
Auto-generated by license-check workflow
* retrigger CI
* update test
* introduce constants for client names and remove wrong ide name for mcp apps support
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
* Bump google/go-github
* chore: regenerate license files
Auto-generated by license-check workflow
* Fix required block
* Go mod vendor and tidy again
* Remove unused fatih/color dependency to fix CI (#2005)
* Initial plan
* Remove unused github.com/fatih/color dependency
The fatih/color package was listed in go.mod but not actually imported
or used anywhere in the codebase. This caused the CI "go mod tidy -diff"
check to fail. Running go mod tidy removed:
- github.com/fatih/color v1.18.0
- github.com/mattn/go-colorable v0.1.13 (transitive)
- github.com/mattn/go-isatty v0.0.20 (transitive)
Fixes the failing ubuntu-latest workflow build.
Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
* Upgrade MCP Go SDK to v1.2.0-pre.1 and add Octicon icons to tools
- Upgrade MCP Go SDK from v1.1.0 to v1.2.0-pre.1 for Icon support
- Add Icon field to ToolsetMetadata for Octicon name assignment
- Add OcticonURL() helper to generate CDN URLs for Octicon SVGs
- Add Icons() method on ToolsetMetadata to generate MCP Icon objects
- Apply icons automatically in RegisterFunc when tool is registered
- Add icons to all 22 toolset metadata constants with appropriate Octicons
- Update server.go to use new Capabilities API (fixes deprecation warnings)
This demonstrates how the toolsets refactor makes adding new features simpler:
icons are defined once in ToolsetMetadata and automatically applied to all
tools in that toolset during registration.
* Update third-party licenses for SDK upgrade
* Address review feedback: enum size validation, mutation fix, tests
- Replace runtime size validation with compile-time enum type (Size with SizeSM=16, SizeLG=24)
- Fix RegisterFunc mutation by making shallow copy of tool before modifying Icons
- Add comprehensive tests for octicons package (URL, Icons, Size constants)
- Add toolsets tests for ToolsetMetadata.Icons(), RegisterFunc mutation prevention,
and existing icon preservation
- Improve icon choices for better visual semantics:
- actions: play → workflow (more specific to GitHub Actions)
- secret_protection: key → shield-lock (better represents protection)
- gists: code → logo-gist (dedicated gist icon exists)
* Add GitHub mark icon to server metadata
Add the mark-github octicon to the server's Implementation struct
so that MCP clients can display the GitHub logo for this server.
The icon is provided in both 16x16 and 24x24 SVG sizes.
* Fix rebase conflicts: use Registry methods and NullTranslationHelper
- Remove duplicate old toolsets functions (AvailableToolsets, GetValidToolsetIDs, GetDefaultToolsetIDs)
- Use Registry.AvailableToolsets() and Registry.HasToolset() instead
- Replace stubTranslator with translations.NullTranslationHelper
- Use new SDK Capabilities struct instead of deprecated HasTools/HasResources/HasPrompts
- Add icon-related tests to registry_test.go
* Use embedded data URIs for Octicon icons
- Embed SVG icons using go:embed for offline use and faster loading
- Convert icons to base64 data URIs at runtime
- Fall back to CDN URL for non-embedded icons
- Add test to verify all toolset icons are properly embedded
- 44 SVG files (22 icons × 2 sizes) totaling ~27KB
* Convert icons from SVG to PNG for MCP client compatibility
MCP clients don't support SVG data URIs, so convert all embedded icons
to PNG format using rsvg-convert.
Changes:
- Convert all 44 SVG icons to PNG format
- Add 8 new icons: copilot, git-merge, repo-forked, star-fill
- Update octicons.go to use PNG MIME type
- Add script/fetch-icons for easy icon management
- Update tests and toolsnaps for PNG format
* Add mark-github icon for server metadata
* Add light/dark theme icons for tools, resources, and prompts
- Switch from size-based (16/24px) to theme-based (light/dark) icons
- Use only 16x16 icons for smaller bundle size
- Generate white (inverted) icons for dark theme backgrounds
- Add icons to resources and prompts (auto-applied from toolset metadata)
- Add 'file' icon for repository content resources
- Update fetch-icons script to generate both theme variants
* Use 24px icons with SVG fill modification for themes
- Switch from 16px to 24px icons for better visibility
- Use SVG fill attribute (#24292f for light, #ffffff for dark) instead
of ImageMagick color inversion for cleaner theme variants
- Remove ImageMagick dependency from fetch-icons script
* Add specific icons for each repository resource type
- repository_content: repo icon
- repository_content_branch: git-branch icon
- repository_content_commit: git-commit icon (new)
- repository_content_tag: tag icon
- repository_content_pr: git-pull-request icon
Resources now have explicit icons set rather than relying on toolset fallback.
* fix: restore Icon fields to toolset metadata and add icons to docs
- Add Icon field to all ToolsetMetadata definitions (lost during rebase conflict resolution)
- Update doc generator to include Octicon icons in toolsets table
- Update doc generator to include icons in tool section headers
- Use Primer Octicons CDN for GitHub markdown compatibility
* feat: add icons to individual tools in documentation
* fix: use repo-local icons with picture element for GitHub theme support
- Reference icons from pkg/octicons/icons/ instead of external CDN
- Use picture element with prefers-color-scheme for light/dark mode
- GitHub markdown renderer will display these correctly
* fix: remove redundant icons from individual tools
Icons are kept on section headers and toolsets table only - having the same
icon on every tool within a section was visually noisy and redundant.
* Add icons to remote server toolsets documentation
* Fix icon paths for docs/remote-server.md
* Add remote-only toolsets with auto-generated documentation and icons guide
- Add ToolsetMetadataCopilot, ToolsetMetadataCopilotSpaces, ToolsetMetadataSupportSearch
- Add RemoteOnlyToolsets() function to return remote-only toolset metadata
- Update doc generator to auto-generate remote-only toolsets table with icons
- Create docs/toolsets-and-icons.md explaining how to add icons to toolsets
- Add link to icons guide in CONTRIBUTING.md
* Add icon validation tests and single source of truth for required icons
- Add pkg/octicons/required_icons.txt as single source of truth for icons
- Add RequiredIcons() function to read the required icons list
- Update script/fetch-icons to read from required_icons.txt
- Update octicons_test.go to use RequiredIcons() instead of hardcoded list
- Add pkg/github/toolset_icons_test.go with:
- TestAllToolsetIconsExist: validates all toolset icons are embedded
- TestToolsetMetadataHasIcons: ensures all toolsets have icons set
- Add 'book' icon for SupportSearch toolset
- Update docs/toolsets-and-icons.md with fetch-icons and CI validation docs
* fix: remove unused icon parameter from writeToolDoc
- Remove unused 'icon' parameter from writeToolDoc function signature
- Fix whitespace inconsistency in octicons_test.go
- Fixes lint failure: unused-parameter revive error
* fix: combine icon with name column in remote docs for proper table rendering
- Move icon from separate column to Name column with <br> separator
- Keep <picture> element for light/dark theme support
- Remove empty icon column that was collapsing to zero width
- Remove unused octiconSimpleImg function
* Initial plan
* Add testify/mock-based HTTP mocking infrastructure and migrate git_test.go
- Add MockHTTPClientWithHandlers helper function for HTTP-level mocking
- Add path pattern matching support for GitHub API endpoints
- Migrate pkg/github/git_test.go from go-github-mock to new infrastructure
- Keep go-github-mock dependency for now (other files still use it)
Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>
* Complete pilot migration and add migration documentation
- Migrate pkg/github/code_scanning_test.go to new infrastructure
- Add comprehensive migration documentation in docs/testing-migration.md
- Fix linter warning in helper_test.go
- All tests and lint checks pass
- 2 of 16 test files migrated, 14 remaining for incremental migration
Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>
* Address code review feedback: consolidate transport implementations
- Remove unused OnAny method
- Extract executeHandler helper to eliminate code duplication
- Consolidate MockHTTPClientWithHandler to use MockHTTPClientWithHandlers
- Simplify transport implementation (single multiHandlerTransport)
- All tests and lint checks pass
Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>
* Remove docs/testing-migration.md per review feedback
Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>
* Reuse mock.EndpointPattern constants instead of hardcoded paths
- Add mock import to code_scanning_test.go and git_test.go
- Replace hardcoded paths with mock.GetRepos*.Pattern references
- Ensures consistency with existing test patterns and easier maintenance
Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>
* Define endpoint path constants in this repo instead of reusing go-github-mock
- Add endpoint pattern constants to helper_test.go
- Update code_scanning_test.go to use new constants
- Update git_test.go to use new constants
- Removes dependency on go-github-mock endpoint patterns
- Prepares for eventual removal of go-github-mock dependency
Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>
Co-authored-by: JoannaaKL <joannaakl@github.com>
* add repo nav tool
* comment responses
* move into git.go
* fix documentation
* Update pkg/github/git.go
Co-authored-by: Adam Holt <omgitsads@github.com>
* Fix undefined variable error in GetRepositoryTree
* Update git.go to use github.com/google/go-github/v77 for consistency with main branch
---------
Co-authored-by: Adam Holt <omgitsads@github.com>
* updates github-mcp-server to go-github/v76
* updates license files
* refactors ListProjects to make use of
google/go-github ProjectsService
* refactors GetProject to make use of google/go-github ProjectsService
* declaring commit without a pointer
* cleanup additional commit pointer
---------
Co-authored-by: Tommaso Moro <37270480+tommaso-moro@users.noreply.github.com>
- Adjust some logs to use structured outputs
- Set stdioserver log prefix as const
- Do not export test func removeTimeAttr
Signed-off-by: Bailey Hayes <behayes2@gmail.com>
Co-authored-by: Matt Holloway <mattdholloway@github.com>
Co-authored-by: JoannaaKL <joannaakl@github.com>
dependabot[bot]