Skip to content

[deep-report] Fix list_code_scanning_alerts token bloat: strip rule.help CWE docs (6K → <500 tokens per call) #30643

@github-actions

Description

@github-actions

Problem Statement

The MCP Structural Analysis (2026-05-06, #30611) identified list_code_scanning_alerts as the most bloated GitHub MCP tool: each call consumes ~6,000 tokens because the rule.help field embeds full CWE documentation for every identical alert in the list. This penalizes any agent that inspects security alerts.

Root Cause

The rule.help field contains ~1,500 tokens of CWE documentation repeated once per alert — even when multiple alerts share the same rule. Deduplicating or stripping this field before returning results would reduce the payload by ~90%.

Expected Impact

  • Reduces per-call token cost from ~6,000 to <500 tokens
  • Allows security-focused agents to scan more alerts per context window
  • Improves usefulness rating from 2/5 to 4/5

Suggested Fix

Option A (preferred): Strip rule.help from the MCP tool response and provide it separately on demand.
Option B: Deduplicate rule.help — include it once per unique rule ID rather than per alert instance.
Option C: Add a include_rule_help: false parameter to opt out.

Estimated Effort

Medium (1–2 hours)

Data Source

MCP Structural Analysis — 2026-05-06 (#30611)

Generated by DeepReport - Intelligence Gathering Agent

Generated by DeepReport - Intelligence Gathering Agent · ● 330.7K ·

  • expires on May 8, 2026, 3:35 PM UTC

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions