[github-actions]

Adds debug log calls (reusing existing logGraphQL) to graphqlRootFields in internal/proxy/graphql.go, covering each early-return path (parse failure, ambiguous/duplicate/missing operation, non-query operation, operation text extraction failure) and the successful parse result.

Log arguments are side-effect free and don't include query text.

Validation: go vet ./internal/proxy, go test ./internal/proxy, and go build pass.

Generated by Go Logger Enhancement · copilot · auto · ~37 AIC · ⊞ 6K · ◷

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 6 target tools absent from catalog (23 read-only tools only)	BLOCKED	⚠️
C	CLI	reads via proxied github CLI	data returned	ALLOWED	✅
D	CLI	REST writes	gh not authenticated (no token)	BLOCKED	⚠️
E	CLI	GraphQL mutations	gh not authenticated (no token)	BLOCKED	⚠️

Overall: INCONCLUSIVE

Notes:

• No write leaked on any surface.
• Part B: all 6 targeted write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) are entirely absent from the gateway-proxied github CLI catalog (23 read-only tools exposed). This confirms backend/toolset config (GITHUB_READ_ONLY=1) but cannot independently confirm the gateway's own DIFC/guard write-blocking layer, since no write-capable tool call ever reached it.
• Part D/E: gh auth status showed not logged in and GH_TOKEN/GITHUB_TOKEN were unset, so REST/GraphQL write probes were not attempted; the token-scope boundary could not be exercised this run.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[Copilot]

🟢 Approval recommended

The logging-only additions use side-effect-free arguments, preserve existing behavior, and introduce no identified blocking issues.

No open issues 🎉

What changed in this PR

Adds diagnostic logging to the proxy’s GraphQL root-field parser without changing parsing behavior or return values.

Changes:

• Logs each early-return path using the existing logGraphQL logger.
• Logs successful root-field counts and names without including query text.

File	Description
internal/​proxy/​graphql.go	Adds diagnostics for parsing failures and successful root-field extraction.

_{Review effort: Max}