Summary
The GitHub guard does not fully cover 1 write operation from the github-mcp-server. The upstream server added a new discussion_comment_write tool that is missing from both WRITE_OPERATIONS and READ_WRITE_OPERATIONS in tools.rs. This allows agents to create/edit discussion comments without triggering DIFC write-path checks.
- MCP tools scanned: 105 (↑ from 102 last run — 3 new tools added upstream)
- CLI write commands scanned: 52
- Guard-covered write tools (tools.rs): 88 (57 write + 31 read-write)
- New gaps found this run: 1
MCP Tool Classification Gaps (tools.rs)
This MCP tool performs write/mutating operations but is missing from WRITE_OPERATIONS or READ_WRITE_OPERATIONS in guards/github-guard/rust-guard/src/tools.rs:
| Tool Name |
Operation Type |
Suggested Classification |
Notes |
discussion_comment_write |
write |
WRITE_OPERATIONS |
Creates or edits GitHub Discussion comments via GraphQL mutations (addDiscussionComment / updateDiscussionComment) |
Suggested fix for tools.rs
// Add to WRITE_OPERATIONS:
pub const WRITE_OPERATIONS: &[&str] = &[
// ... existing entries ...
"discussion_comment_write", // creates or edits GitHub Discussion comments
];
MCP Tool DIFC Labeling Gaps (tool_rules.rs)
In addition to the classification gap, the following new upstream tools have no explicit match arm in apply_tool_labels:
| Tool Name |
Data Scope |
Suggested Labels |
Risk |
discussion_comment_write |
repo-scoped |
secrecy: S(repo), integrity: writer |
High (write path, no DIFC rule) |
list_repository_collaborators |
repo-scoped |
secrecy: S(repo), integrity: reader |
Low (read-only, but returns who has write/admin access) |
For discussion_comment_write, add a match arm modeled after other *_write tools (e.g., issue_write).
For list_repository_collaborators, add a match arm modeled after other repo-scoped list tools (e.g., list_issues).
References
Generated by GitHub Guard Coverage Checker (MCP + CLI) · ● 1.2M · ◷
Summary
The GitHub guard does not fully cover 1 write operation from the github-mcp-server. The upstream server added a new
discussion_comment_writetool that is missing from bothWRITE_OPERATIONSandREAD_WRITE_OPERATIONSintools.rs. This allows agents to create/edit discussion comments without triggering DIFC write-path checks.MCP Tool Classification Gaps (tools.rs)
This MCP tool performs write/mutating operations but is missing from
WRITE_OPERATIONSorREAD_WRITE_OPERATIONSinguards/github-guard/rust-guard/src/tools.rs:discussion_comment_writeWRITE_OPERATIONSSuggested fix for tools.rs
MCP Tool DIFC Labeling Gaps (tool_rules.rs)
In addition to the classification gap, the following new upstream tools have no explicit match arm in
apply_tool_labels:discussion_comment_writelist_repository_collaboratorsFor
discussion_comment_write, add a match arm modeled after other*_writetools (e.g.,issue_write).For
list_repository_collaborators, add a match arm modeled after other repo-scoped list tools (e.g.,list_issues).References