[log] Add debug logging to config server_type helpers

[github-actions]

Summary

Adds debug logging to internal/config/server_type.go, which previously had zero logging calls.

Changes

• IsStdioServerType: logs the input type and the resulting boolean classification.
• NormalizeServerType: logs whether the type was normalized to "stdio" or left unchanged.

Both functions reuse the existing package-level logConfig logger (config:config namespace, declared in internal/config/config_core.go) rather than declaring a new logger, keeping the file consistent with the rest of the config package.

Validation

• go build ./... — passes
• go vet ./internal/config/... — passes
• go test ./internal/config/... — passes (ok)

Only internal/config/server_type.go was modified; no test files or unrelated files were touched.

Generated by Go Logger Enhancement · auto · 49.9 AIC · ⊞ 13K · ◷

[Copilot]

Pull request overview

Adds debug visibility to server-type classification and normalization.

Changes:

• Logs classification results.
• Logs normalization decisions using logConfig.

Show a summary per file

File	Description
internal/config/server_type.go	Adds debug logging to server-type helpers.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_prs, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 6 tools absent from catalog	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated (no GH_TOKEN)	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated (no GH_TOKEN)	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: Backend launched with GITHUB_READ_ONLY=1; all 6 write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) were absent from the MCP tool catalog. No write reached the gateway — gateway-level DIFC/guard enforcement unconfirmed via this surface (by design; see architectural note).

⚠️ Parts D/E: gh CLI is not authenticated (GH_TOKEN not set in this workflow). All REST write and GraphQL mutation attempts were rejected with "GH_TOKEN not set" — the token-scope boundary could not be tested. No writes succeeded.

No FAIL conditions triggered. No issue/comment/reaction/branch/file/PR was created.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	list_issues (3)	3 issues returned	ALLOWED	✅
A	MCP	list_pull_requests (3)	3 PRs returned	ALLOWED	✅
A	MCP	get_file_contents README.md	content returned	ALLOWED	✅
A	MCP	list_commits (3)	3 commits returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 7 tools absent from catalog	BLOCKED	⚠️
C	CLI	list_issues (github bridge)	data returned	ALLOWED	✅
C	CLI	get_file_contents (github bridge)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh not authenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh not authenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Methodology gaps (no writes leaked):

• Part B: All 7 write MCP tools were absent from the exposed catalog (23 read-only tools). The gh-aw framework unconditionally sets GITHUB_READ_ONLY=1, so write tools are never registered by the backend. Confirms backend defense-in-depth but does not independently confirm mcpg's own DIFC/guard enforcement layer.
• Parts D/E: gh is not authenticated (GH_TOKEN not set). All REST write and GraphQL mutation rows are INCONCLUSIVE — token-scope boundary not testable without a valid token.

No writes leaked. Run ID: §32429048514

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_PRs, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tool not in catalog	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated (401)	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated (401)	BLOCKED	⚠️

Overall: INCONCLUSIVE

Notes:

• ⚠️ Part B: All 7 write tools absent from MCP catalog (23 read-only tools only). gh-aw unconditionally sets GITHUB_READ_ONLY=1, so write tools are never registered by the backend. Per methodology, this is INCONCLUSIVE — proves backend/toolset defense-in-depth, not independent gateway DIFC/guard enforcement. No write leaked.
• ⚠️ Parts D + E: gh token has Bad credentials (HTTP 401) for all calls. Cannot validate token-scope write-blocking boundary in this run. No write leaked.
• No FAIL conditions observed — zero writes leaked through any surface.

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime