Problem Description

The audit MCP tool returns raw debug log output instead of the expected structured JSON audit report, making the output unusable for programmatic consumption or human review.

Command/Tool

• Tool: agenticworkflows-audit
• MCP Server: agentic-workflows

Steps to Reproduce

1. Use the agentic-workflows MCP tool to audit a workflow run:

   agenticworkflows-audit with run_id_or_url: "22080602159"
   

2. Observe the output

Expected Behavior

According to the tool description, the audit command should return a JSON object with:

• overview: Basic run information (run_id, workflow_name, status, conclusion, timestamps, duration, event, branch, url, logs_path)
• metrics: Execution metrics (token_usage, estimated_cost, turns, error_count, warning_count)
• jobs: List of job details (name, status, conclusion, duration)
• downloaded_files: List of artifact files
• missing_tools: Tools that were requested but not available
• mcp_failures: MCP server failures
• errors: Error details (file, line, type, message)
• warnings: Warning details
• tool_usage: Tool usage statistics
• firewall_analysis: Network firewall analysis

Actual Behavior

The command returns raw debug log output from the compiler/parser:

workflow:script_registry Creating new script registry +120ns
workflow:domains Loading ecosystem domains from embedded JSON +719µs
workflow:domains Loaded 21 ecosystem categories +113µs
workflow:expression_patterns Initializing expression pattern regex compilation +824µs
workflow:js Script registration completed (embedded scripts removed) +687µs
workflow:permissions_validation Loading GitHub toolsets permissions from embedded JSON +338µs
cli:audit Starting audit for workflow run: runID=22080602159
cli:logs_metrics Extracting log metrics from: /tmp/gh-aw/aw-mcp/logs/run-22080602159
workflow:copilot_logs JSONL parsing failed or no entries found, falling back to debug log format

Environment

• Repository: github/gh-aw
• Run ID: 22080927302
• Date: 2026-02-16
• Tested Run IDs: 22080602159 (success), 22079737118 (failure)

Impact

• Severity: High
• Frequency: Always (100% reproduction rate across multiple runs)
• Workaround: None - audit functionality is essentially broken

Root Cause Hypothesis

The MCP tool appears to be capturing debug logs (logger output sent to stderr) instead of the structured audit report. This suggests:

1. The audit command may be writing debug logs to stdout instead of stderr
2. The MCP server may be capturing the wrong output stream
3. The structured JSON report may not be generated at all

Logs/Diagnostics

Tested with two workflow runs:

• Run 22080602159: CI Failure Doctor (success, 7.3m duration)
• Run 22079737118: Weekly Safe Outputs Specification Review (failure, 48s duration)

Both returned identical debug log format instead of structured JSON.

Additional Context

This issue was discovered during systematic exploratory testing of the audit, logs, and compile commands. The logs and compile commands work correctly and return properly structured data. Only the audit command exhibits this issue.

The debug logs suggest the audit logic is executing (downloading artifacts, parsing logs, extracting metrics), but the final output format is incorrect.

Generated by Daily CLI Tools Exploratory Tester

• expires on Feb 23, 2026, 11:56 PM UTC