fix(mcp): scope the static MCP token to an operator-configured repo allowlist

[JSONbored]

What

GITTENSORY_MCP_TOKEN is documented (README, CLI) as an ordinary end-user credential — a normal alternative to gittensory-mcp login for any miner or maintainer. But requireRepoManageAccess/requireRepoApprovalQueueAccess in src/mcp/server.ts unconditionally trusted every non-session identity (if (this.identity.kind !== "session") return;), so any holder of that one shared secret could call gittensory_propose_action / gittensory_list_pending_actions / gittensory_decide_pending_action on every repo the App is installed on — not just repos they actually maintain.

Fix

Scope the static mcp identity specifically to a new MCP_ACTUATION_REPO_ALLOWLIST env var (comma/whitespace owner/repo list, or */all to explicitly opt back into the old unscoped behavior). Unset defaults to deny-all — an operator must explicitly opt a repo in.

api/internal static identities are untouched — unlike mcp, those are operator-only Worker secrets that are never documented or handed out as an end-user credential, so the existing "static identities are trusted" design remains correct for them.

Breaking change

Any self-hoster currently relying on GITTENSORY_MCP_TOKEN for approval-queue actuation needs to set MCP_ACTUATION_REPO_ALLOWLIST (or * to keep today's behavior) after this ships. Given the severity of unscoped any-repo actuation via a single shared secret, deny-by-default is the correct posture — this isn't a regression to avoid, it's the fix.

Tests

• isMcpActuationRepoAllowed direct unit tests: unset/empty → deny, explicit match → allow, sibling repo → deny, case-insensitive, comma/whitespace parsing, */all wildcard.
• MCP integration tests: a static mcp caller is denied on propose_action and decide_pending_action when the repo isn't allowlisted (and the pending action is left untouched, not silently accepted/rejected); allowed once the repo is explicitly listed; a sibling repo not in a narrower allowlist stays denied.
• Regression coverage for api/internal static identities remaining unconditionally trusted on both gates (this branch was previously covered incidentally by the same identity the fix now scopes — added explicit tests so it isn't accidentally narrowed by a future change).

Full unsharded test:coverage green; typecheck green.

Advances #1936. Closes #2253.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-01 17:11:51 UTC}

7 files · 1 AI reviewer · no blockers · readiness 75/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review

Review summary
The change correctly scopes only the static MCP actor through a deny-by-default repo allowlist while preserving the existing trusted behavior for api/internal static identities. The helper is simple, case-insensitive, and covered by direct and integration tests for denied, allowed, wildcard, and sibling-repo cases. The main remaining gap in the visible diff is rollout/documentation completeness for a breaking operator-facing env contract outside the new UI docs page.

Nits — 6 non-blocking

• nit: apps/gittensory-ui/src/routes/docs.self-hosting-configuration.tsx:77 documents the new breaking env var in the UI docs, but the visible diff does not show matching README or CLI/help text updates; I could not verify those files from the provided content, so confirm the documented GITTENSORY_MCP_TOKEN paths now mention MCP_ACTUATION_REPO_ALLOWLIST.
• nit: test/unit/mcp-automation-state.test.ts:211 says createTestEnv({}) has the allowlist unset, but test/helpers/d1.ts now defaults MCP_ACTUATION_REPO_ALLOWLIST to "*", so the comment should be corrected to avoid misleading future maintainers.
• apps/gittensory-ui/src/routes/docs.self-hosting-configuration.tsx:77: mirror this warning in the README and any CLI/env reference that currently presents GITTENSORY_MCP_TOKEN as a normal MCP credential, or point to those existing updates if they are in another file.
• test/unit/mcp-automation-state.test.ts:211: change the comment to say the api/internal test proves those actors ignore the MCP allowlist despite the test default wildcard, or override MCP_ACTUATION_REPO_ALLOWLIST to "" for a clearer assertion.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2253
Related work	⚠️ 2 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (size label size:M; 1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 67 registered-repo PR(s), 57 merged, 590 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 67 PR(s), 590 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 67 PR(s), 590 issue(s).
• Related work: Items reference the same linked issue fix(mcp): a static GITTENSORY_MCP_TOKEN grants actuation access to every repo, not just the operator's #2253. (issue #2253)
• Related work: Open PR work references issue fix(mcp): a static GITTENSORY_MCP_TOKEN grants actuation access to every repo, not just the operator's #2253. (issue #2253)

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Review top overlaps.
• Add a concise scope and risk note.
• Triage stale or unlinked PRs.
• No action.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.71%. Comparing base (17d70b2) to head (b3e2842).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2274   +/-   ##
=======================================
  Coverage   95.71%   95.71%           
=======================================
  Files         222      222           
  Lines       24661    24672   +11     
  Branches     8949     8956    +7     
=======================================
+ Hits        23605    23616   +11     
  Misses        433      433           
  Partials      623      623           

Files with missing lines	Coverage Δ
src/auth/security.ts	98.76% <100.00%> (+0.08%)	⬆️
src/mcp/server.ts	95.76% <100.00%> (+0.03%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	b3e2842	Commit Preview URL Branch Preview URL	Jul 01 2026, 01:12 PM