⚡ Match Highlights: github/gh aw mcpg/pull/

Copilot · 2026-10-25T05:37:26Z

The coverage report flagged six GitHub read tools for missing DIFC labels. Existing rules already cover most; this change tightens organization-search secrecy and repository-tree descriptions while protecting that coverage.

Labeling
- Treat search_orgs as access-sensitive: private:user secrecy with GitHub-controlled integrity.
- Give get_repository_tree a repo:owner/repo description, retaining repository-visibility secrecy and writer integrity.
Coverage
- Centralize the six tool-name constants.
- Add regression cases for public/private repository metadata and authenticated/requested-user starred repositories; retain Copilot Space assertions.

Fixes [guard-coverage] Guard coverage gap: 6 operations from github-mcp-server / GitHub CLI not fully covered #15490

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

🟡 Changes recommended

The organization-search change blocks public search results under strict/filter enforcement, even with repos: "all".

1 open issue

search_orgs incorrectly blocked by private-user clearance · New

What changed in this PR

Refines GitHub read-metadata labeling in the Rust DIFC guard and protects coverage for the six tools identified in #15490.

Changes:

Labels organization search as private-user metadata.
Adds repository-scoped descriptions for repository trees while preserving visibility and integrity rules.
Centralizes six tool names and extends metadata-label regression tests.

File	Description
`guards/github-guard/rust-guard/src/labels/tool_rules.rs`	Updates labeling rules and adds regression cases.
`guards/github-guard/rust-guard/src/labels/mod.rs`	Updates the organization-search secrecy assertion.
`guards/github-guard/rust-guard/src/labels/constants.rs`	Defines constants for the six read tools.

_{Review effort: Max}

-        | "get_copilot_space"
+        | tool_names::LIST_STARRED_REPOSITORIES
+        | tool_names::GET_COPILOT_SPACE
+        | tool_names::SEARCH_ORGS


lpcox · 2026-10-25T17:20:09Z

@copilot address review feedback

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-10-25T17:29:45Z

@copilot address review feedback

Addressed in 59d62cd. search_orgs remains publicly searchable, while GraphQL organization(...) now maps to graphql_organization with its separate private:user label.

lpcox · 2026-10-25T17:43:05Z

@copilot address security review feedback

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

+                let query = get_string_field(args, field_names::QUERY).unwrap_or_default();
+
+                // If query looks repo-scoped, prefer repo-private scoping derived from args.
+                if query.contains("repository(") || query.contains("repositories(") {


-	// Organization queries
-	{queryPattern: regexp.MustCompile(`(?i)\borganization\s*\(`), toolName: "search_orgs"},
+	// Organization queries (root-field constrained to reduce misrouting from token injection/mixed queries)
+	{queryPattern: regexp.MustCompile(`(?is)^\s*(?:query|mutation|subscription)?\s*[A-Za-z0-9_]*\s*(?:\([^)]*\))?\s*(?:@[A-Za-z0-9_]+(?:\([^)]*\))?\s*)*\{\s*organization\s*\(`), toolName: "graphql_organization"},


github-actions · 2026-10-25T17:52:37Z

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	no writes leaked; all 7 targets absent from tool catalog ("unknown tool")	BLOCKED	⚠️
C	CLI	reads	data	ALLOWED	✅
D	CLI	REST writes	not attempted — gh unauthenticated in this env	BLOCKED	⚠️
E	CLI	GraphQL mutations	not attempted — gh unauthenticated in this env	BLOCKED	⚠️

Overall: INCONCLUSIVE

Notes:

Part A/C: all 4 MCP reads (list_issues, list_pull_requests, get_file_contents, list_commits) returned real data via the gateway-backed github CLI proxy.
Part B: catalog exposed only 23 read-only tools; no write tool names were registered at all, so add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request all failed with Error [-32602]: unknown tool. This confirms backend GITHUB_READ_ONLY=1 config, not an independent gateway-level DIFC/guard block — hence ⚠️ INCONCLUSIVE per methodology, not a pass of gateway enforcement.
Part D/E: gh auth status showed no authenticated host, so REST/GraphQL write probes were skipped rather than producing misleading 401s; ⚠️ INCONCLUSIVE.
No reaction, star, issue, comment, branch, file, or PR was created or leaked in this run.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

lpcox · 2026-10-25T17:53:42Z

@copilot fix the failing ci checks https://github.com/github/gh-aw-mcpg/actions/runs/40218232613/job/121243925552?pr=15496 and https://github.com/github/gh-aw-mcpg/actions/runs/40218234714/job/121243933425?pr=15496

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-10-25T18:01:53Z

@copilot address security review feedback

Addressed in 00a9c34. GraphQL routing now uses parsed root fields to prevent mixed-query introspection bypass and organization misclassification; the guard adds repository-scoped secrecy for ambiguous organization queries.

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-10-25T18:11:13Z

@copilot address security review feedback

Addressed in 5b6e2ca. GraphQL routing now parses the selected operation, limits the introspection bypass to a single introspection root, and applies conservative repository secrecy for nested or mixed repository fields.

@copilot fix the failing ci checks https://github.com/github/gh-aw-mcpg/actions/runs/40218232613/job/121243925552?pr=15496 and https://github.com/github/gh-aw-mcpg/actions/runs/40218234714/job/121243...

Fixed in 5b6e2ca. The Rust guard compile errors and GraphQL proxy/race-test failures are resolved; make agent-finished now passes, including full Go and Rust tests.

lpcox · 2026-10-25T18:27:52Z

@copilot fix the failed linting test https://github.com/github/gh-aw-mcpg/actions/runs/40219631113/job/121252244029?pr=15496

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-10-25T18:37:04Z

@copilot fix the failed linting test https://github.com/github/gh-aw-mcpg/actions/runs/40219631113/job/121252244029?pr=15496

Fixed the lint failure by replacing the field comparison chain with a switch; targeted lint, proxy tests, and make agent-finished pass. Commit: db8ab07.

Initial plan

3d9892f

Copilot AI assigned Copilot and lpcox Oct 25, 2026

Copilot started work on behalf of lpcox October 25, 2026 05:37

View session

Copilot AI linked an issue Oct 25, 2026 that may be closed by this pull request

[guard-coverage] Guard coverage gap: 6 operations from github-mcp-server / GitHub CLI not fully covered #15490

Closed

Complete DIFC coverage for GitHub read metadata tools

88c22ff

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix guard coverage gap for 6 operations~~ Tighten DIFC labeling for GitHub read metadata Oct 25, 2026

Copilot finished work on behalf of lpcox October 25, 2026 05:46

Copilot AI requested a review from lpcox October 25, 2026 05:46

lpcox marked this pull request as ready for review October 25, 2026 17:03

Copilot AI max review requested due to automatic review settings October 25, 2026 17:03

Copilot started reviewing on behalf of lpcox October 25, 2026 17:04

View session

Copilot AI reviewed Oct 25, 2026

View reviewed changes

Comment thread guards/github-guard/rust-guard/src/labels/tool_rules.rs Outdated

| "get_copilot_space"

| tool_names::LIST_STARRED_REPOSITORIES

| tool_names::GET_COPILOT_SPACE

| tool_names::SEARCH_ORGS

Copilot started work on behalf of lpcox October 25, 2026 17:20

View session

Separate public org search from GraphQL labels

59d62cd

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-advanced-security AI found potential problems Oct 25, 2026

View reviewed changes

Comment thread internal/proxy/graphql.go Resolved

Comment thread internal/proxy/graphql.go Resolved

Comment thread guards/github-guard/rust-guard/src/labels/tool_rules.rs Resolved

Copilot finished work on behalf of lpcox October 25, 2026 17:31

Potential fix for pull request finding

7f25775

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Copilot started work on behalf of lpcox October 25, 2026 17:43

View session

lpcox and others added 2 commits October 25, 2026 10:43

Potential fix for pull request finding

bb27f23

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Potential fix for pull request finding

d2adffc

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

This comment has been minimized.

Sign in to view

github-advanced-security AI found potential problems Oct 25, 2026

View reviewed changes

Comment thread guards/github-guard/rust-guard/src/labels/tool_rules.rs Resolved

Potential fix for pull request finding

ffe3c20

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

github-advanced-security AI found potential problems Oct 25, 2026

View reviewed changes

Copilot started work on behalf of lpcox October 25, 2026 17:54

View session

Harden GraphQL DIFC classification

00a9c34

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox October 25, 2026 18:03

Copilot AI and others added 2 commits October 25, 2026 18:04

Harden GraphQL DIFC routing

c3cd038

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Scope organization GraphQL repositories

5b6e2ca

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox October 25, 2026 18:11

Copilot started work on behalf of lpcox October 25, 2026 18:28

View session

Fix GraphQL lint diagnostic

db8ab07

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox October 25, 2026 18:37

lpcox merged commit 3a80e06 into main Oct 25, 2026
28 checks passed

lpcox deleted the copilot/guard-coverage-fix branch October 25, 2026 18:55

Conversation

Copilot AI commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

lpcox commented Oct 25, 2026

Uh oh!

Copilot AI commented Oct 25, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lpcox commented Oct 25, 2026

Uh oh!

This comment has been minimized.

Uh oh!

github-actions Bot commented Oct 25, 2026

🔒 mcpg Read-Only Stress — default

Uh oh!

lpcox commented Oct 25, 2026

Uh oh!

Copilot AI commented Oct 25, 2026

Uh oh!

Copilot AI commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lpcox commented Oct 25, 2026

Uh oh!

Copilot AI commented Oct 25, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Oct 25, 2026 •

edited

Loading

Copilot AI commented Oct 25, 2026 •

edited

Loading