[docs] docs: tighten MCP gateway guard-policy prose#44365
Conversation
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
Hey One small note:
The PR is currently in draft state. Once the content has been reviewed for accuracy (especially the condensed If you would like a final accuracy pass on the condensed sections, you can assign this prompt to your coding agent: Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "patchdiff.githubusercontent.com"See Network Configuration for more information.
|
There was a problem hiding this comment.
Pull request overview
This PR tightens and de-bloats the MCP gateway reference documentation by consolidating repetitive guard-policy and cross-visibility explanations into concise prose while keeping the existing requirements, examples, and compliance references intact.
Changes:
- Condensed
approval-labels/refusal-labelssemantics into single-paragraph descriptions. - Merged several bullet-heavy sections around
sink-visibilityandacceptinteraction into clearer prose. - Simplified the
private-to-public-flowsopt-out explanation (constraints + compiler responsibilities) without changing the stated behavior.
Show a summary per file
| File | Description |
|---|---|
| docs/src/content/docs/reference/mcp-gateway.md | Reduces repetitive wording across guard-policy and cross-visibility sections while preserving requirements, examples, and compliance references. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Low
| 2. If the server ID appears in `gateway.sinkVisibilityExemptServers` → the default is NOT applied. | ||
| 3. If `sinkVisibilityExemptServers` contains `"*"` → no server receives the default. | ||
| 4. If `forcePublicRepos` is `false` → all servers are implicitly exempt (blanket opt-out). | ||
| The default applies only when the server is not `safe-outputs` (or legacy `safeoutputs`), the server is not listed in `gateway.sinkVisibilityExemptServers`, that exemption list does not contain `"*"`, and `forcePublicRepos` is not `false`. |
|
🎉 This pull request is included in a new release. Release: |
Summary
Tightens the prose in
docs/src/content/docs/reference/mcp-gateway.md, sections 10.5–10.9, with no semantic or behavioral changes. Verbose bullet-list and numbered-step blocks are collapsed into compact inline sentences while preserving all normative content.Changes
approval-labelsrefusal-labelsacceptinteractionprivate-to-public-flowsFiles changed
docs/src/content/docs/reference/mcp-gateway.md— prose-only edits (~66 lines removed, ~18 added)Impact