Pass MCP environment variables to gateway server by Copilot · Pull Request #8677 · github/gh-aw

Copilot · 2026-01-02T20:42:29Z

The MCP gateway server (awmg) was failing to spawn MCP clients because secrets and environment variables configured in the "Setup MCPs" step were not available when the gateway process started.

Changes

Centralized environment variable collection (pkg/workflow/mcp_servers.go)
- Added collectMCPEnvironmentVariables() helper that gathers all MCP-related env vars (GitHub tokens, safe-inputs/outputs config, Playwright secrets)
- Refactored generateMCPSetup() to use centralized helper, eliminating ~80 lines of duplicate logic
Gateway step generation (pkg/workflow/gateway.go)
- Modified generateMCPGatewaySteps() and generateMCPGatewayStartStep() to accept mcpEnvVars map[string]string parameter
- Gateway step now renders env: block with alphabetically sorted variables matching "Setup MCPs" step
Test coverage (pkg/workflow/gateway_test.go)
- Updated existing test calls to pass env var map
- Added tests for env block rendering with and without variables

Result

The "Start MCP Gateway" step now includes the same environment variables as "Setup MCPs":

- name: Start MCP Gateway
  env:
    GH_AW_SAFE_INPUTS_API_KEY: ${{ steps.safe-inputs-start.outputs.api_key }}
    GH_AW_SAFE_INPUTS_PORT: ${{ steps.safe-inputs-start.outputs.port }}
    GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  run: |
    $AWMG_CMD --config /home/runner/.copilot/mcp-config.json --port 8080 ...

Gateway can now access all necessary secrets when spawning MCP clients.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/user
- Triggering command: /usr/bin/gh gh api user --jq .login wright" --help REDACTED nfig/composer/vendor/bin/bash g_.a 17gxpsi6sEqQqZZz-50 rg/toolchain@v0.0.1-go1.25.0.linux-amd64/pkg/too/home/REDACTED/work/gh-aw/gh-aw/.github/workflows infocmp -1 (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

gentic Task: Pass MCP Secrets/Variables to Gateway Server
Problem
When the MCP gateway server (awmg) starts, it needs access to secrets and environment variables that were configured in the "Setup MCPs" step. Currently, these secrets are only available during MCP config file generation but not when the gateway process starts, causing it to fail when spawning MCP clients.

Objective
Modify the gateway step generation to pass through all necessary environment variables from the "Setup MCPs" step, ensuring the gateway has access to:

GitHub MCP authentication tokens
Safe-inputs/outputs configuration and secrets
Playwright domain secrets
Agentic-workflows tokens
Tool-specific secrets from safe-inputs configuration
Technical Approach

Create Environment Variable Collection Helper
File: pkg/workflow/mcp_servers.go

Add function collectMCPEnvironmentVariables(tools, mcpTools, workflowData, hasAgenticWorkflows) that returns map[string]string
Centralize logic to collect all MCP-related environment variables
Include: GITHUB_MCP_SERVER_TOKEN, GH_AW_SAFE_OUTPUTS, GH_AW_SAFE_INPUTS_*, tool-specific secrets, GITHUB_TOKEN, Playwright secrets, upload-assets env vars
2. Update Gateway Step Generation
File: pkg/workflow/gateway.go

Modify generateMCPGatewaySteps signature to accept mcpEnvVars map[string]string parameter
Modify generateMCPGatewayStartStep signature to accept mcpEnvVars map[string]string parameter
In generateMCPGatewayStartStep, render an env: block when len(mcpEnvVars) > 0
Sort environment variable keys alphabetically for consistent output
Add sort to imports
3. Refactor MCP Setup
File: pkg/workflow/mcp_servers.go

In generateMCPSetup function, replace inline env var collection with call to collectMCPEnvironmentVariables
Pass the collected mcpEnvVars to generateMCPGatewaySteps
4. Update Tests
File: pkg/workflow/gateway_test.go

Update all calls to generateMCPGatewaySteps to pass empty map[string]string{} as third parameter
Update all calls to generateMCPGatewayStartStep to include mcpEnvVars parameter
Add new test TestGenerateMCPGatewayStartStep_WithEnvVars to verify env block rendering
Add new test TestGenerateMCPGatewayStartStep_WithoutEnvVars to verify no env block when empty
Acceptance Criteria
Gateway start step includes env: block with all necessary secrets/variables
Environment variables match those in "Setup MCPs" step
Variables are sorted alphabetically for consistent output
All existing gateway tests pass
New tests validate env var passthrough behavior
Build succeeds without errors
No duplicate env var collection logic
Files to Modify
pkg/workflow/mcp_servers.go - Add helper, refactor setup
pkg/workflow/gateway.go - Update signatures, add env rendering
pkg/workflow/gateway_test.go - Update tests, add new tests

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-01-02T21:06:32Z

🤖 DIAGNOSTIC COMPLETE: Smoke Copilot No Firewall STATUS: ALL_UNITS_OPERATIONAL. MISSION_SUCCESS.

github-actions · 2026-01-02T21:06:34Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-01-02T21:06:34Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-02T21:06:35Z

✅ Firewall validation complete... Smoke Codex Firewall confirmed network sandboxing is operational. 🛡️

github-actions · 2026-01-02T21:06:35Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-02T21:06:35Z

🎉 Yo ho ho! Smoke Copilot Safe Inputs found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-02T21:06:35Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-01-02T21:06:37Z

📰 VERDICT: Smoke Copilot Playwright has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-02T21:08:29Z

Smoke Test Results

✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-copilot-20666695037.txt
✅ Bash Tool: Verified file content successfully
❌ Safe Input gh Tool: Not available in current environment

Status: FAIL (safeinputs-gh tool not accessible)

AI generated by Smoke Copilot Safe Inputs

github-actions · 2026-01-02T21:08:36Z

Smoke Test Results: Copilot Engine (Run 20666695018)

Last 2 Merged PRs:

Add test coverage for concurrent artifact downloads in logs orchestrator #8679: Add test coverage for concurrent artifact downloads in logs orchestrator
Fix TypeScript compilation errors in mark_pull_request_as_ready_for_review.cjs #8678: Fix TypeScript compilation errors in mark_pull_request_as_ready_for_review.cjs

Test Results:

✅ GitHub MCP: Successfully retrieved merged PRs
✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-copilot-20666695018.txt
✅ Bash Tool: File verification successful
✅ GitHub MCP Default Toolset: get_me correctly fails (not in default toolset)
✅ Cache Memory: Created /tmp/gh-aw/cache-memory/smoke-test-20666695018.txt
❌ MCP Gateway: Container not running (port 3000 connection refused)

Overall Status: PASS (5/6 tests passed; MCP gateway not expected in all environments)

cc: @pelikhan

AI generated by Smoke Copilot

github-actions · 2026-01-02T21:08:42Z

Firewall smoke test results:

PRs: Add test coverage for concurrent artifact downloads in logs orchestrator #8679 "Add test coverage for concurrent artifact downloads in logs orchestrator"; Add interactive MCP server configuration with Huh forms #8660 "Add interactive MCP configuration"
OpenAI curl access blocked: ✅
Blocked domain curl (example.com): ✅
GitHub MCP merged PR fetch: ✅
File write/read /tmp/gh-aw/agent/smoke-test-codex-firewall-20666695043.txt: ✅
Network: SANDBOXED
Overall: PASS

AI generated by Smoke Codex Firewall

github-actions · 2026-01-02T21:08:52Z

Smoke Test Results - Copilot Engine (No Firewall)

✅ Test file creation: Successfully created /tmp/gh-aw/agent/smoke-test-copilot-20666695056.txt
✅ Playwright navigation: Successfully navigated to https://github.com
✅ Page title verification: Confirmed title "GitHub · Change is constant. GitHub keeps you ahead. · GitHub"
❌ GitHub API access: GitHub API tools returned 401 errors (expected - no GITHUB_TOKEN in this context)
❌ gh CLI verification: Confirmed gh CLI is not authenticated (expected behavior)

Note: GitHub API access via tools requires authentication which is not available in this workflow context. This is expected behavior for workflows without explicit GitHub token permissions.

AI generated by Smoke Copilot No Firewall

github-actions · 2026-01-02T21:09:17Z

PRs:

Add test coverage for concurrent artifact downloads in logs orchestrator
Fix TypeScript compilation errors in mark_pull_request_as_ready_for_review.cjs
Tests:
✅ GitHub MCP PR fetch
✅ File write/read in /tmp/gh-aw/agent
✅ Cache memory write/read
✅ Playwright title contains "GitHub"
❌ safeinputs-gh "gh issues list --limit 3" (command not found)
Overall: FAIL

AI generated by Smoke Codex

github-actions · 2026-01-02T21:09:33Z

Smoke Test Results (Run 20666695046)

✅ Cache Memory Test: Successfully wrote and verified file at /tmp/gh-aw/cache-memory/smoke-test-20666695046.txt

❌ Playwright MCP Test: Cannot test - requires full GitHub Actions environment with compiled workflow

❌ Safe Input GH Tool Test: Tool safeinputs-gh not available in current environment

Overall Status: ❌ FAIL (2/3 tests failed due to environment constraints)

AI generated by Smoke Copilot Playwright

github-actions · 2026-01-02T21:09:40Z

Smoke Test Results - Claude Engine

Last 2 Merged PRs:

Add test coverage for concurrent artifact downloads in logs orchestrator #8679: Add test coverage for concurrent artifact downloads in logs orchestrator
Fix TypeScript compilation errors in mark_pull_request_as_ready_for_review.cjs #8678: Fix TypeScript compilation errors in mark_pull_request_as_ready_for_review.cjs

Test Results:

✅ GitHub MCP: Retrieved recent PRs
✅ File Write: Created test file successfully
✅ Bash Tool: Verified file contents
✅ Playwright: Navigated to GitHub, title verified "GitHub · Change is constant. GitHub keeps you ahead. · GitHub"
✅ Cache Memory: Created and verified cache file
❌ Safe Input gh Tool: Tool not available in environment

Status: PASS (5/6 tests passed)

AI generated by Smoke Claude

Initial plan

4e6f29b

Copilot AI assigned Copilot and pelikhan Jan 2, 2026

Copilot started work on behalf of pelikhan January 2, 2026 20:42 View session

Copilot AI and others added 3 commits January 2, 2026 20:51

Implement MCP environment variable passthrough to gateway server

2c9c7a2

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Verify MCP environment variable passthrough works correctly

88a3712

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Finalize MCP gateway environment variable passthrough implementation

600ab11

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Pass MCP secrets and variables to gateway server~~ Pass MCP environment variables to gateway server Jan 2, 2026

Copilot AI requested a review from pelikhan January 2, 2026 21:05

Copilot finished work on behalf of pelikhan January 2, 2026 21:05

pelikhan added the smoke label Jan 2, 2026

github-actions Bot added the smoke-copilot label Jan 2, 2026

github-actions Bot added the smoke-codex-firewall label Jan 2, 2026

github-actions Bot added the smoke-copilot-no-firewall label Jan 2, 2026

Add changeset [skip-ci]

70c3367

github-actions Bot added the smoke-claude label Jan 2, 2026

Merge branch 'main' into copilot/pass-mcp-secrets-to-gateway-again

191e83e

pelikhan marked this pull request as ready for review January 2, 2026 21:12

pelikhan merged commit 611fd2f into main Jan 2, 2026
47 of 48 checks passed

pelikhan deleted the copilot/pass-mcp-secrets-to-gateway-again branch January 2, 2026 21:12

Conversation

Copilot AI commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Result

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

github-actions Bot commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 2, 2026 • edited by agentic-workflows-dev Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 2, 2026

Uh oh!

github-actions Bot commented Jan 2, 2026

Smoke Test Results: Copilot Engine (Run 20666695018)

Uh oh!

github-actions Bot commented Jan 2, 2026

Uh oh!

github-actions Bot commented Jan 2, 2026

Smoke Test Results - Copilot Engine (No Firewall)

Uh oh!

github-actions Bot commented Jan 2, 2026

Uh oh!

github-actions Bot commented Jan 2, 2026

Smoke Test Results (Run 20666695046)

Uh oh!

github-actions Bot commented Jan 2, 2026

Smoke Test Results - Claude Engine

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jan 2, 2026 •

edited

Loading

github-actions Bot commented Jan 2, 2026 •

edited

Loading

github-actions Bot commented Jan 2, 2026 •

edited

Loading

github-actions Bot commented Jan 2, 2026 •

edited

Loading

github-actions Bot commented Jan 2, 2026 •

edited

Loading

github-actions Bot commented Jan 2, 2026 •

edited by agentic-workflows-dev Bot

Loading

github-actions Bot commented Jan 2, 2026 •

edited

Loading

github-actions Bot commented Jan 2, 2026 •

edited

Loading

github-actions Bot commented Jan 2, 2026 •

edited

Loading