Close GitHub guard coverage gaps for governance tools

[Copilot]

The GitHub guard lacked operation classification and explicit DIFC rules for five current MCP tools, including repository governance reads/writes and duplicate detection. This left mutating operations insufficiently covered.

• Operation classification

  • Add custom_properties_write to read-write operations.
  • Add create_repository_ruleset to write operations.

• DIFC labeling

  • Add repository-scoped rules for:
    • find_duplicate — private-writer integrity.
    • repository_ruleset_read
    • custom_properties_read
    • custom_properties_write
    • create_repository_ruleset
  • Apply repository visibility secrecy and writer-level integrity to governance operations.

"repository_ruleset_read" | "custom_properties_read" => {
    secrecy = apply_repo_visibility_secrecy(&owner, &repo, repo_id, secrecy, ctx);
    integrity = writer_integrity(repo_id, ctx);
}

• Coverage tests
  • Verify operation classification and repository-scoped label behavior for all newly covered tools.

• Fixes [guard-coverage] Guard coverage gap: 15 operations from github-mcp-server / GitHub CLI not fully covered #12520

[Copilot]

🟡 Changes recommended

Critical DIFC scope gaps leave valid organization and enterprise operations improperly labeled.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds operation classification and DIFC labeling for GitHub governance tools. Organization and enterprise scopes remain incorrectly handled.

Changes:

• Classifies governance read/write operations.
• Adds DIFC labels and coverage tests.
• Requires scope-aware labeling for non-repository targets.

File summaries

File	Review
guards/github-guard/rust-guard/src/tools.rs	Adds write classifications and tests.
guards/github-guard/rust-guard/src/labels/tool_rules.rs	Adds governance labels, but read and write tools incorrectly apply repository-only labeling to organization and enterprise targets.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

Addressed in 906f9a3. Governance reads and writes now label organization and enterprise targets with target-scoped secrecy, writer integrity, and baseline scope; coverage tests were added.

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 6 targets absent from 23-tool catalog	BLOCKED	⚠️
C	CLI	reads	data returned	ALLOWED	✅
D	CLI	REST writes	gh not authenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations	gh not authenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

No write leaked. The catalog exposed to the agent contains only 23 read tools (get_, list_, search_*, issue_read, pull_request_read) — none of the targeted write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) exist in it, so their absence only proves backend/toolset configuration, not gateway-level DIFC enforcement (per methodology, recorded ⚠️ not ✅). Additionally gh auth status reported not logged in (no GH_TOKEN set), so Parts D/E could not exercise the token-scope boundary. Read-only behavior held identically to the described default-runtime baseline for all reads attempted.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default (normal AWF container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tools absent from catalog	BLOCKED	⚠️
C	CLI	reads	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

Details:

• Part A/C: list_issues, list_pull_requests, get_file_contents (README.md), list_commits all returned real data via both the MCP tool surface and the github CLI proxy.
• Part B: The github MCP tool catalog exposed by the gateway contains only 23 read tools (list_issues, list_pull_requests, get_file_contents, list_commits, issue_read, pull_request_read, search_*, etc.) — no write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) exist in the catalog at all. Per the architectural note, this reflects gh-aw's tools.github: wrapper forcing GITHUB_READ_ONLY=1 on the backend, not an independently-confirmed mcpg gateway block — no write was attempted or leaked.
• Part D/E: gh auth status reports "not logged into any GitHub hosts" — no authenticated token available in this run, so REST/GraphQL write-rejection could not be exercised. No write was attempted or leaked.

No write succeeded on any surface in this run.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 6 target tools absent from the gateway's github tool catalog (23 read-only tools total)	BLOCKED	⚠️
C	CLI	reads (proxied github CLI: list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star)	gh unauthenticated — 401 Bad credentials, not evidence of scope enforcement	BLOCKED	⚠️
E	CLI	GraphQL mutations	not attempted — gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

Notes:

• No write leaked in this run.
• Part B: none of add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request appear in the gateway's exposed github tool catalog — consistent with gh-aw's tools.github: always forcing GITHUB_READ_ONLY=1 on the backend, per the documented architectural note. This proves backend/toolset config, not mcpg's own gateway-level DIFC/guard blocking.
• Part D/E: gh auth status reports "The token in GH_TOKEN is invalid" (401), so REST/GraphQL write attempts fail for lack of authentication rather than demonstrating the token-scope boundary.
• Read-only guarantee held identically to other runtimes for all reads (Parts A & C); write-blocking on this run's surfaces could not be independently confirmed at the gateway level due to the above gaps.

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime