Repository navigation
test(agentic-engineering): pin the bundled GitHub servers' limits - #657
Merged
Merged
Conversation
github's exclusion list is the only thing keeping its merge, repository, file-write and workflow tools away, and a probe cannot stand in for it: GitHub offers delete_repository only to clients speaking MCP 2026-07-28 with elicitation. Make the headers helper's self-test fail if any excluded tool leaves the list, or if github-ghas-tools loses its read-only URL, header or toolsets, with negative controls for both. Explain the mechanism in the README. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
@coderabbitai full review |
Action performed
|
|
No actionable comments were generated in the recent review.
 |
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title names the test area and the change: it pins the limits of the bundled GitHub servers. The changeset adds self-test checks to github-mcp-headers.test.sh for the 12 excluded tools, the read-on… |
| Description check | |
The description gives the reason for the change and explains the README clarification about delete_repository. It lists the test changes, the 7.1.1 version bump with changelog entry, and the validatio… |
| Docstring Coverage | |
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Title check
-
Explanation
The title names the test area and the change: it pins the limits of the bundled GitHub servers. The changeset adds self-test checks to github-mcp-headers.test.sh for the 12 excluded tools, the read-only URL, header, toolsets, and sign-in helper of github-ghas-tools, plus negative controls. The title fits the main change, though it does not mention the README or version bump.
Full details: Description check
-
Explanation
The description gives the reason for the change and explains the README clarification about delete_repository. It lists the test changes, the 7.1.1 version bump with changelog entry, and the validation steps. It is directly related to the changeset.
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (7 skipped: 7 unsupported.)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Contributor
Author
|
Readiness at
🤖 Generated with Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The independent review of #656 found the last open questions about the bundled
githubserver. Two follow-ups came out of it. First, GitHub offersdelete_repositoryonly to clients that speak MCP protocol 2026-07-28 and declare elicitation, which is why ordinary probes never listed it while a Claude Code session did. Second, nothing stopped a later edit from silently dropping a tool fromgithub's exclusion list.What
github-mcp-headers.test.shnow fails if any of the 12 excluded tools leavesgithub'sX-MCP-Exclude-Tools. It also fails ifgithub-ghas-toolsloses its read-only URL, itsX-MCP-Readonlyheader or its toolsets, or if either server stops signing in through the helper. Two negative controls cover the checks: one dropsdelete_repository, the other putsgithub-ghas-toolsback ongithub's URL.delete_repository.Validation
.mcp.json, and both negative controls are rejected. CI runs this test automatically with the other plugin*.test.shfiles.validate-manifests.sh,check-skill-licenses.sh, the version-bump check, the desired-state digests and the changelog tests pass. The bump moved all five manifests, the Codex one included.🤖 Generated with Claude Code