Align OpenTelemetry endpoint validation with MCP Gateway spec 1.16.0 (HTTP or HTTPS)

[Copilot]

Spec 1.16.0 allows gateway.opentelemetry.endpoint to use either HTTP or HTTPS, but the gateway still enforced HTTPS-only in both runtime validation and schema. This updates validation, schema, and compliance tests to match the new requirement, and bumps the reported spec version.

• Validation logic (runtime)

  • validateOpenTelemetryConfig now accepts http:// and https:// endpoints when gateway.opentelemetry is present.
  • Non-HTTP(S) schemes are still rejected.
  • Error/suggestion text updated from HTTPS-only to HTTP-or-HTTPS.

• Config schema (contract)

  • Updated opentelemetry.endpoint pattern from HTTPS-only to HTTP-or-HTTPS:
    • ^(https?://.+|\\$\\{[A-Z_][A-Z0-9_]*\\})$
  • Updated schema description text to match the new requirement.

• Compliance/test semantics

  • Updated OTEL compliance tests (T-OTEL-002/T-OTEL-004) to reflect:
    • accept HTTP/HTTPS
    • reject non-HTTP(S)
  • Added/updated coverage in validation and schema tests for:
    • http://127.0.0.1:4318/... accepted
    • grpc://... rejected

• Reported spec version

  • Bumped MCPGatewaySpecVersion from 1.15.0 to 1.16.0.

if enforceHTTPS && cfg.Endpoint != "" {
    if !strings.HasPrefix(cfg.Endpoint, "https://") && !strings.HasPrefix(cfg.Endpoint, "http://") {
        return InvalidValue("endpoint",
            fmt.Sprintf("opentelemetry endpoint must use HTTP or HTTPS, got '%s'", cfg.Endpoint),
            "gateway.opentelemetry.endpoint",
            "Use an HTTP or HTTPS URL")
    }
}

• Fixes [compliance] Compliance Gap: OTLP endpoint validation still rejects (redacted) (spec 1.16.0 requires accepting HTTP or HTTPS) #11585

[Copilot]

Pull request overview

Aligns OpenTelemetry endpoint handling with MCP Gateway spec 1.16.0.

Changes:

• Allows HTTP and HTTPS OTLP endpoints.
• Updates schema and compliance coverage.
• Reports spec version 1.16.0.

Show a summary per file

File	Description
internal/server/unified.go	Bumps reported spec version.
internal/config/validation_tracing.go	Relaxes endpoint scheme validation.
internal/config/validation_schema_test.go	Tests schema HTTP acceptance.
internal/config/validation_otel_test.go	Tests runtime validation branches.
internal/config/validation_gateway_coverage_test.go	Covers gateway-level validation.
internal/config/schema/mcp-gateway-config.schema.json	Allows HTTP or HTTPS endpoints.
internal/config/config_tracing.go	Updates specification references.
internal/config/config_tracing_test.go	Updates compliance test semantics.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 8/8 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	list_issues	3 issues returned	ALLOWED	✅
A	MCP	list_pull_requests	2 PRs returned	ALLOWED	✅
A	MCP	get_file_contents (README.md)	data returned	ALLOWED	✅
A	MCP	list_commits	3 commits returned	ALLOWED	✅
B	MCP	add_issue_comment	unknown tool [-32602]	BLOCKED	⚠️
B	MCP	star_repository	unknown tool [-32602]	BLOCKED	⚠️
B	MCP	issue_write	unknown tool [-32602]	BLOCKED	⚠️
B	MCP	create_branch	unknown tool [-32602]	BLOCKED	⚠️
B	MCP	create_or_update_file	unknown tool [-32602]	BLOCKED	⚠️
B	MCP	create_pull_request	unknown tool [-32602]	BLOCKED	⚠️
C	CLI	list_issues	data returned	ALLOWED	✅
C	CLI	list_pull_requests	data returned	ALLOWED	✅
C	CLI	list_commits	data returned	ALLOWED	✅
C	CLI	get_file_contents	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	401 Bad credentials	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	401 Bad credentials	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Gaps:

1. Part B (MCP writes): All 6 write tools absent from the 23-tool catalog (GITHUB_READ_ONLY=1 in backend). Refusals are Error[-32602]: unknown tool — this confirms the gh-aw framework's backend-level defense-in-depth, but does not independently exercise mcpg's DIFC/guard enforcement layer, since no write-capable backend was exposed.
2. Parts D & E (CLI REST/GraphQL): GH_TOKEN is invalid (401 Bad credentials). The token-scope boundary cannot be validated in this run. All write attempts returned 401 due to unauthenticated gh, not gateway blocking.

No writes leaked. No issues, comments, branches, files, or PRs were created.

References: §32430966141

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file_contents/list_commits)	data returned (3+2+25KB+3 items)	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 7 tools absent from catalog	BLOCKED	⚠️
C	CLI	reads (list_issues/get_file_contents via github proxy)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh not authenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh not authenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All 7 write tool targets absent from the MCP tool catalog — the gateway backend runs with GITHUB_READ_ONLY=1, so write tools are never registered. This confirms the gh-aw framework's own defense-in-depth guarantee (backend never exposes write tools), but cannot independently confirm the gateway's DIFC/guard enforcement layer. No writes leaked.

⚠️ Parts D & E: gh CLI is not authenticated in this environment (GH_TOKEN not set). All REST and GraphQL write attempts returned "not logged in" rather than a GitHub API 403. The token-scope boundary (read-only REST) cannot be verified in this run. No writes leaked.

Methodology gap: Gateway-level DIFC write enforcement for MCP tools can only be confirmed by a probe that launches the GitHub MCP server outside gh-aw's GITHUB_READ_ONLY=1 wrapper. This is tracked as follow-up work. Independent coverage exists in internal/guard and internal/difc unit tests.

References: §32430966179

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime