Split GitHub guard write inventory by source

[Copilot]

The GitHub guard mixed upstream MCP tools, GitHub CLI-only mutations, and deprecated compatibility aliases in the same write inventories. That made coverage drift checks noisy and obscured whether entries were real upstream MCP coverage or local synthetic guard coverage.

• Split write/read-write inventories
  • Kept WRITE_OPERATIONS and READ_WRITE_OPERATIONS as upstream MCP-derived buckets.
  • Added explicit buckets for CLI-only operations, guard/runtime synthetic writes, and deprecated aliases.
  • Preserved classification behavior by having is_write_operation() and is_read_write_operation() consult all relevant buckets.

pub const CLI_WRITE_OPERATIONS: &[&str] = &[
    "cancel_workflow_run",
    "set_secret",
    "transfer_issue",
];

pub const DEPRECATED_WRITE_ALIASES: &[&str] = &[
    "run_workflow",
    "delete_workflow_run_logs",
];

• Added inventory invariants

  • Assert every write/read-write entry belongs to exactly one source bucket.
  • Validate all source buckets remain sorted for binary_search.

• Updated coverage-checker contract

  • MCP drift checks now consider only upstream MCP buckets.
  • CLI/synthetic/deprecated entries are audited against their explicit source categories instead of being reported as stale MCP entries.

• Fixes [guard-coverage] Guard coverage gap: 39 operations from github-mcp-server / GitHub CLI not fully covered #11425

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	list_issues	3 issues returned	ALLOWED	✅
A	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A	MCP	get_file_contents (README.md)	content returned	ALLOWED	✅
A	MCP	list_commits	3 commits returned	ALLOWED	✅
B	MCP	add_issue_comment (reaction)	tool absent from catalog	BLOCKED	⚠️
B	MCP	star_repository	tool absent from catalog	BLOCKED	⚠️
B	MCP	issue_write / create_issue	tool absent from catalog	BLOCKED	⚠️
B	MCP	add_issue_comment (body)	tool absent from catalog	BLOCKED	⚠️
B	MCP	create_branch	tool absent from catalog	BLOCKED	⚠️
B	MCP	create_or_update_file	tool absent from catalog	BLOCKED	⚠️
B	MCP	create_pull_request	tool absent from catalog	BLOCKED	⚠️
C	CLI	list_issues	3 issues returned	ALLOWED	✅
C	CLI	get_file_contents (README.md)	content returned	ALLOWED	✅
D	CLI	REST writes (all)	gh not authenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (all)	gh not authenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Methodology gaps (not failures):

• Part B: All 7 write tool targets were absent from the MCP tool catalog. The backend runs with GITHUB_READ_ONLY=1 (gh-aw framework enforces this unconditionally), so write tools are never registered. This confirms the gh-aw defense-in-depth layer but does not independently confirm mcpg's own DIFC/guard enforcement. No write leaked.
• Parts D/E: gh is not authenticated in this environment (gh auth status → not logged in). All REST write and GraphQL mutation attempts were skipped — INCONCLUSIVE, not PASS. No write was attempted or leaked.

No writes succeeded. No leak detected.

References: §32101183724

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc)

Part	Surface	Op	Result	Expected	Status
A	MCP	list_issues	3 issues returned	ALLOWED	✅
A	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A	MCP	get_file_contents (README.md)	content returned	ALLOWED	✅
A	MCP	list_commits	3 commits returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 7 tools absent from catalog	BLOCKED	⚠️
C	CLI	list_issues (github CLI)	data returned	ALLOWED	✅
C	CLI	get_file_contents (github CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: The gateway-backed github CLI exposes only 23 read-only tools (backend launched with GITHUB_READ_ONLY=1). All 7 targeted write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) were absent from the catalog — this confirms backend-level defense-in-depth but does not independently confirm the gateway's own DIFC/guard enforcement layer, since no write-capable tool call reached the proxy.

⚠️ Parts D & E: gh is not authenticated in this runner environment (GH_TOKEN not set). All REST write and GraphQL mutation attempts returned "not logged in" errors before reaching GitHub's API. The token-scope boundary cannot be validated in this run.

No writes leaked. All enforcement surfaces either blocked or were inconclusive due to structural limitations of the test environment (backend read-only mode + unauthenticated gh).

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[Copilot]

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Balanced

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

Addressed in 5553764: added source-specific reverse checks/report sections for CLI, synthetic, and deprecated guard buckets, and recompiled the workflow lock metadata.

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	not in catalog	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: Tool catalog contains 23 read-only tools only — all 7 write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) are absent. This confirms GITHUB_READ_ONLY=1 backend defense-in-depth but does not independently verify mcpg's own DIFC/guard enforcement layer (write call never reaches a write-capable backend).

⚠️ Parts D/E: gh CLI is unauthenticated in this environment (GH_TOKEN invalid, HTTP 401). Token-scope boundary for REST writes and GraphQL mutations cannot be validated this run. No writes were attempted/succeeded.

No writes leaked. No FAIL conditions observed.

References: §32152693613

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime