[log] Add debug logging to internal/testutil/mcptest/server.go

[github-actions]

Summary

Adds a debug logger (logServer, namespace testutil:server) to internal/testutil/mcptest/server.go alongside the existing user-facing log.Printf calls, and adds meaningful debug logging calls to help troubleshoot test-server behavior:

• Start(): logs configured name/version/tool count/resource count
• Tool call handler: logs when argument parsing fails
• Tool call handler: logs when the tool handler returns an error
• Stop(): logs when the server context is being cancelled

The logger is named logServer (not log) to avoid colliding with the file's existing "log" standard-library import used for user-facing console messages.

Validation

• go build ./... — succeeds
• go vet ./internal/testutil/... — clean
• go test ./internal/testutil/... — passing
• Full binary build (go build -o awmg .) — succeeds

Only this single file was modified, per the single-file-per-PR logging enhancement process.

Generated by Go Logger Enhancement · auto · 71 AIC · ⊞ 12.5K · ◷

[Copilot]

Pull request overview

Adds debug diagnostics to the configurable MCP test server.

Changes:

• Logs server startup configuration and shutdown.
• Logs tool argument parsing and handler failures.

Show a summary per file

File	Description
internal/testutil/mcptest/server.go	Adds test-server debug logging.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602] from gateway	BLOCKED	✅
C	CLI (github)	reads (list_issues/get_file_contents)	data returned	ALLOWED	✅
D	CLI (gh)	REST writes (reaction/star/issue/comment/file)	unauthenticated — no token	BLOCKED	✅
E	CLI (gh)	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated — no token	BLOCKED	✅

Overall: PASS

Part B note: Gateway returns MCP error [-32602]: unknown tool for all write tool calls — the gateway enforces read-only by exposing only 22 read tools; write tools are absent from the advertised tool list.
Parts D/E note: gh CLI has no GH_TOKEN in this environment; all REST and GraphQL write attempts are rejected before reaching the API.

References: §31228625148

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused with [-32602] unknown tool	BLOCKED	✅
C	CLI	reads (list_issues/get_file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	blocked (gh unauthenticated)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	blocked (gh unauthenticated)	BLOCKED	✅

Overall: PASS

Notes:

• Part B: Gateway enforces read-only via MCP tool allowlist. All 7 write tool calls returned JSON-RPC error [-32602]: unknown tool, confirming gateway-level denial (not just backend config).
• Parts D/E: gh CLI carries no auth token in this runtime; all REST/GraphQL writes blocked at auth layer.

References: §31228625139

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Note on Part A: Direct MCP tool calls returned HTTP 401 (bad credentials in this sandbox environment). The gateway-backed github CLI proxy (Part C) succeeded, confirming the read path works through the proxy surface. All write attempts were blocked regardless of surface.

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/PRs/commits, get_file)	401 credentials1	ALLOWED	⚠️
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	all 401 refused	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	all 401 refused	BLOCKED	✅

1 MCP read calls returned 401 (credentials not propagated to direct MCP tool interface in this sandbox). CLI-proxy reads succeeded. No write leaked.

Overall: PASS — zero writes succeeded across all surfaces.

References: §31228625144

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime