Cover public labels for search_users

[Copilot]

GitHub guard coverage identified operations lacking explicit DIFC rule coverage. The production rules already label search_users as public GitHub-controlled metadata; this adds the missing regression assertion.

• Guard coverage
  • Includes search_users in the existing public-metadata label test.
  • Verifies empty secrecy and project:github integrity.

for tool in &[
    "search_orgs",
    "search_users",
    // ...
] {
    // expects public secrecy and GitHub-project integrity
}

• Fixes [guard-coverage] Guard coverage gap: 14 operations from github-mcp-server / GitHub CLI not fully covered #12021

[Copilot]

Pull request overview

Adds search_users to a public-metadata label test, duplicating existing coverage.

Changes:

• Adds search_users to the shared label assertion table.

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/labels/tool_rules.rs	Extends the public GitHub metadata test table.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all tools absent from catalog	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated (GH_TOKEN unset)	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated (GH_TOKEN unset)	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All 7 write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) returned Error [-32602]: unknown tool. This confirms the backend runs with GITHUB_READ_ONLY=1 (gh-aw's defense-in-depth), but does not confirm the gateway's own DIFC/guard enforcement layer, since write tools never reach the backend.

⚠️ Parts D & E: gh CLI has no GH_TOKEN set in this environment — every call returned "set the GH_TOKEN environment variable". The token-scope boundary (read-only REST/GraphQL) could not be validated. No writes were attempted against the GitHub API.

No write succeeded in any part. ✅ No enforcement gap detected; INCONCLUSIVE gaps noted above.

References: §33184877360

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	list_issues	3 issues returned	ALLOWED	✅
A	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A	MCP	get_file_contents (README.md)	content returned	ALLOWED	✅
A	MCP	list_commits	commits returned	ALLOWED	✅
B	MCP	add_issue_comment	tool absent from catalog	BLOCKED	⚠️
B	MCP	star_repository	tool absent from catalog	BLOCKED	⚠️
B	MCP	issue_write	tool absent from catalog	BLOCKED	⚠️
B	MCP	create_branch	tool absent from catalog	BLOCKED	⚠️
B	MCP	create_or_update_file	tool absent from catalog	BLOCKED	⚠️
B	MCP	create_pull_request	tool absent from catalog	BLOCKED	⚠️
C	CLI	list_issues	issues returned	ALLOWED	✅
C	CLI	get_file_contents	README content returned	ALLOWED	✅
D	CLI REST	all write attempts	gh unauthenticated (401)	BLOCKED	⚠️
E	CLI GraphQL	all mutations	gh unauthenticated (401)	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B (MCP writes): All 6 write tools are absent from the exposed catalog (github CLI shows 23 read-only tools only). This confirms GITHUB_READ_ONLY=1 backend defense-in-depth but does not independently exercise mcpg's DIFC/guard enforcement layer.

⚠️ Parts D & E (proxied CLI): gh reports Bad credentials (HTTP 401) — token in GH_TOKEN is invalid. All REST write attempts and GraphQL mutations are INCONCLUSIVE; unauthenticated 401s cannot confirm token-scope boundary enforcement.

No write leaked. Run ID: §33184877430

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	list_issues	3 issues returned	ALLOWED	✅
A	MCP	list_pull_requests	1 PR returned	ALLOWED	✅
A	MCP	get_file_contents README.md	content returned	ALLOWED	✅
A	MCP	list_commits	3 commits returned	ALLOWED	✅
B	MCP	add_issue_comment (reaction)	"Permission denied" (tool absent from catalog)	BLOCKED	⚠️
B	MCP	star_repository	"Permission denied" (tool absent from catalog)	BLOCKED	⚠️
B	MCP	issue_write/create	tool absent from catalog	BLOCKED	⚠️
B	MCP	add_issue_comment (body)	"Permission denied" (tool absent from catalog)	BLOCKED	⚠️
B	MCP	create_branch	"Permission denied" (tool absent from catalog)	BLOCKED	⚠️
B	MCP	create_or_update_file	tool absent from catalog	BLOCKED	⚠️
B	MCP	create_pull_request	tool absent from catalog	BLOCKED	⚠️
C	CLI	list_issues via github CLI	data returned	ALLOWED	✅
C	CLI	get_file_contents via github CLI	README.md returned	ALLOWED	✅
D	CLI	REST writes (D1–D6)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (E1–E3)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Methodology gaps (not failures):

1. Part B — Backend runs with GITHUB_READ_ONLY=1 so write tools are never registered; the gateway's own DIFC/guard enforcement layer is structurally untestable on this surface. No writes leaked.
2. Parts D & E — gh has no GH_TOKEN; all write attempts return "set the GH_TOKEN environment variable" before any network call. The unauthenticated rejection proves no write leaked, but does not confirm the token-scope boundary.

Run: §33184877416

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime