Skip to content

[guard-coverage] Guard coverage gap: 1 write operation from github-mcp-server not classified #5799

@github-actions

Description

@github-actions

Summary

The GitHub guard does not fully cover 1 write operation from the github-mcp-server. The upstream server added a new discussion_comment_write tool that is missing from both WRITE_OPERATIONS and READ_WRITE_OPERATIONS in tools.rs. This allows agents to create/edit discussion comments without triggering DIFC write-path checks.

  • MCP tools scanned: 105 (↑ from 102 last run — 3 new tools added upstream)
  • CLI write commands scanned: 52
  • Guard-covered write tools (tools.rs): 88 (57 write + 31 read-write)
  • New gaps found this run: 1

MCP Tool Classification Gaps (tools.rs)

This MCP tool performs write/mutating operations but is missing from WRITE_OPERATIONS or READ_WRITE_OPERATIONS in guards/github-guard/rust-guard/src/tools.rs:

Tool Name Operation Type Suggested Classification Notes
discussion_comment_write write WRITE_OPERATIONS Creates or edits GitHub Discussion comments via GraphQL mutations (addDiscussionComment / updateDiscussionComment)

Suggested fix for tools.rs

// Add to WRITE_OPERATIONS:
pub const WRITE_OPERATIONS: &[&str] = &[
    // ... existing entries ...
    "discussion_comment_write",  // creates or edits GitHub Discussion comments
];

MCP Tool DIFC Labeling Gaps (tool_rules.rs)

In addition to the classification gap, the following new upstream tools have no explicit match arm in apply_tool_labels:

Tool Name Data Scope Suggested Labels Risk
discussion_comment_write repo-scoped secrecy: S(repo), integrity: writer High (write path, no DIFC rule)
list_repository_collaborators repo-scoped secrecy: S(repo), integrity: reader Low (read-only, but returns who has write/admin access)

For discussion_comment_write, add a match arm modeled after other *_write tools (e.g., issue_write).
For list_repository_collaborators, add a match arm modeled after other repo-scoped list tools (e.g., list_issues).


References

Generated by GitHub Guard Coverage Checker (MCP + CLI) · ● 1.2M ·

  • expires on May 30, 2026, 3:24 AM UTC

Metadata

Metadata

Assignees

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions