[mcp-tools] Sync GitHub MCP toolsets mapping: add find_duplicate and copilot_issue_intents

[github-actions]

Summary

Audit run §31313649181 compared pkg/workflow/data/github_toolsets_permissions.json against upstream github/github-mcp-server (main @ eb4c099e05ef622445e930b18682a0464f22418f) and found two gaps:

1. find_duplicate was added to the issues toolset upstream (feature-flag gated: FeatureFlagDuplicateDetection). It was missing from our mapping.
2. copilot_issue_intents is a new upstream toolset (non-default, opt-in) containing assign_copilot_to_issue_with_intent — a variant of Copilot issue assignment that carries rationale, confidence, and is_suggestion intent metadata. It was entirely missing from our mapping.

Changes

• pkg/workflow/data/github_toolsets_permissions.json: bumped version 2.4 → 2.5; added find_duplicate to issues.tools; added the new copilot_issue_intents toolset entry.
• .github/aw/github-mcp-server.md: documented both additions (new toolset section, new table row), bumped Last Updated to 2026-08-09, and added clarifying notes for two tools that have no source in the OSS github-mcp-server repo but are confirmed legitimate remote-only additions:
  • create_pull_request_with_copilot — explicitly documented upstream as remote-only (docs/remote-server.md).
  • check_dependency_vulnerabilities — no source, string, or doc reference found anywhere in the OSS repo, but empirically confirmed working in gh-aw's live remote-mode MCP sessions. Left in the mapping (removing it would break a real capability) and flagged with a note for future maintainers.

Not changed

• No existing tool-to-toolset assignments were altered; only additive changes.
• The 26 feature-flagged "granular" issue/PR write-alternate tools discovered during this audit were intentionally left undocumented in the JSON mapping (would duplicate/bloat the consolidated write tools already covering the same operations) — noted instead in the accompanying discussion report.

Verification

• JSON validated with python3 -c "import json; json.load(open(...))" — parses cleanly, 23 toolsets (up from 22).
• Cross-checked against pkg/github/copilot.go, pkg/github/security_advisories.go, pkg/github/dependabot.go, and docs/remote-server.md in github/github-mcp-server @ eb4c099e05ef622445e930b18682a0464f22418f.

---

Warning

Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files. A human must create the pull request manually.

Protected files

• .github/aw/github-mcp-server.md

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission.

Create the pull request manually

# Download the patch from the workflow run
gh run download 31313649181 -n agent -D /tmp/agent-31313649181

# Create a new branch
git checkout -b audit/github-mcp-toolsets-sync-20260809-1e2c409afe898044 main

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-31313649181/aw-audit-github-mcp-toolsets-sync-20260809.patch

# Push the branch and create the pull request
git push origin audit/github-mcp-toolsets-sync-20260809-1e2c409afe898044
gh pr create --title '[mcp-tools] Sync GitHub MCP toolsets mapping: add find_duplicate and copilot_issue_intents' --base main --head audit/github-mcp-toolsets-sync-20260809-1e2c409afe898044 --repo github/gh-aw

Generated by 📊 GitHub MCP Remote Server Tools Report Generator · agent · 245.9 AIC · ⌖ 23.7 AIC · ⊞ 14.1K · ◷

• expires on Aug 11, 2026, 4:50 AM UTC-08:00