Skip to content

Ensure allowed tool filter for mcp-servers section#19801

Merged
pelikhan merged 5 commits intomainfrom
copilot/ensure-allowed-tool-filter
Mar 6, 2026
Merged

Ensure allowed tool filter for mcp-servers section#19801
pelikhan merged 5 commits intomainfrom
copilot/ensure-allowed-tool-filter

Conversation

Copy link
Contributor

Copilot AI commented Mar 6, 2026

Summary

Ensures the allowed tool filter in mcp-servers is passed through to the compiled MCP config output for all engines, not just Copilot.

Changes

pkg/workflow/mcp_config_custom.go — The "tools" field (which carries the allowed list) was previously only rendered when RequiresCopilotFields was true (Copilot engine only). Fixed in two places:

  • HTTP property order: "tools" is now always included in the JSON format property order, not Copilot-only
  • Property inclusion gate: "tools" is now included whenever RequiresCopilotFields is set or when allowed tools are explicitly specified — so Claude, Codex, and Gemini engines now correctly pass the filter through to the MCP gateway config

pkg/workflow/mcp_config_compilation_test.go — Added TestMCPServersAllowedToolFilterCompilation to verify end-to-end that the allowed field in mcp-servers entries compiles correctly into the "tools" field in the output. Covers five scenarios across Copilot and Claude engines:

  • HTTP server with specific allowed tools → renders as "tools": ["get_data", "list_items"]
  • Stdio server with specific allowed tools → renders as "tools": ["run_query", "fetch_results"]
  • Copilot server with no allowed field → defaults to "tools": ["*"]
  • Claude server with specific allowed tools → allowed list is passed through
  • Claude server with no allowed field → no tools field rendered (no wildcard added for non-Copilot engines)

Security Summary

No security vulnerabilities introduced or discovered. The changes ensure the MCP gateway tool filter is correctly propagated for all engines.


💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.



✨ PR Review Safe Output Test - Run 22754642684

💥 [THE END] — Illustrated by Smoke Claude ·

Copilot AI and others added 2 commits March 6, 2026 03:16
… add compilation test

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
@pelikhan
Copy link
Contributor

pelikhan commented Mar 6, 2026

@copilot do not ignore tool allowed list, pass it along remove warnings

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Mar 6, 2026

@copilot do not ignore tool allowed list, pass it along remove warnings

Done in 98d2568. The allowed list from mcp-servers is now passed through to the compiled MCP config for all JSON-format engines (not just Copilot) — when an allowed list is specified it renders as "tools": ["tool1", "tool2"]; when absent, no tools field is added for non-Copilot engines. The warning I had added was removed.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw foreach(ini_get_maintenance 64/pkg/tool/linurun git rev-�� --show-toplevel 64/pkg/tool/linuGO111MODULE /usr/bin/git (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -bool -buildtags 64/bin/go -errorsas -ifaceassert -nilfunc /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linuGOPROXY -ato�� -bool -buildtags ache/go/1.25.0/x64/bin/go -errorsas -ifaceassert -nilfunc go (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /home/REDACTED/.local/bin/bash GOINSECURE GOMOD GOMODCACHE bash (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel 64/pkg/tool/linuGO111MODULE /usr/bin/git res_import_test.git table_tools_testrev-parse 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linuGOPROXY /usr/bin/git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE cal/bin/bash GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel 64/pkg/tool/linuGO111MODULE /usr/bin/git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE bash GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha --show-toplevel 64/pkg/tool/linuGO111MODULE /usr/bin/git ILrzhVffl .cfg go git rev-�� --show-toplevel 64/pkg/tool/linu/sys/fs/cgroup /usr/bin/git om/davecgh/go-spgit om/davecgh/go-sprev-parse t git (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE p/bin/bash GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE rgo/bin/bash GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha 57 --log-level 64/bin/go --log-target journal-or-kmsg (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

@github-actions
Copy link
Contributor

github-actions bot commented Mar 6, 2026

✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready.

@github-actions
Copy link
Contributor

github-actions bot commented Mar 6, 2026

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

@github-actions
Copy link
Contributor

github-actions bot commented Mar 6, 2026

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

@github-actions
Copy link
Contributor

github-actions bot commented Mar 6, 2026

🎬 THE ENDSmoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

@github-actions
Copy link
Contributor

github-actions bot commented Mar 6, 2026

Agent Container Tool Check

Tool Status Version
bash 5.2.21
sh available
git 2.53.0
jq 1.7
yq 4.52.4
curl 8.5.0
gh 2.87.3
node 20.20.0
python3 3.12.3
go 1.24.13
java 10.0.102
dotnet not found

Result: 11/12 tools available ⚠️

Overall Status: FAIL — dotnet (.NET runtime) is not available in this container.

🔧 Tool validation by Agent Container Smoke Test ·

@github-actions
Copy link
Contributor

github-actions bot commented Mar 6, 2026

Commit pushed: 3296539

Generated by Changeset Generator

@github-actions
Copy link
Contributor

github-actions bot commented Mar 6, 2026

Smoke Test Results (Run §22754642699)

Test Status
GitHub MCP
Safe Inputs GH CLI
Serena MCP
Playwright
Web Fetch
File Writing
Bash Tool
Discussion Interaction
Build gh-aw
Discussion Creation
Workflow Dispatch
PR Review

Overall: ⚠️ PARTIAL PASS — Serena MCP tools not available

CC @pelikhan

📰 BREAKING: Report filed by Smoke Copilot ·

Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR correctly fixes the allowed tool filter for mcp-servers so it applies to all engines (not just Copilot). The logic change is minimal and well-targeted. Test coverage is thorough with cases for both Claude and Copilot engines, including positive and negative assertions.

📰 BREAKING: Report filed by Smoke Copilot

if renderer.RequiresCopilotFields || len(mcpConfig.Allowed) > 0 {
existingProperties = append(existingProperties, prop)
}
case "container":
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The condition renderer.RequiresCopilotFields || len(mcpConfig.Allowed) > 0 correctly extends tool filtering support beyond just Copilot. This ensures that when allowed is explicitly specified in mcp-servers, the filter is passed to the MCP gateway for all engines. Good fix! 🎯


// TestDevModeAgenticWorkflowsContainer verifies that the agentic-workflows MCP server
// uses the locally built Docker image in dev mode instead of alpine:latest
func TestDevModeAgenticWorkflowsContainer(t *testing.T) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Comprehensive test coverage with 5 test cases covering HTTP, stdio, no-allowed-field defaults, and both Claude and Copilot engines. The test for the Claude case without allowed verifying absence of "tools": is a nice negative assertion. Well-structured! ✅

@github-actions
Copy link
Contributor

github-actions bot commented Mar 6, 2026

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

@github-actions
Copy link
Contributor

github-actions bot commented Mar 6, 2026

Smoke Test Results - Run §22754642684

Test Status
1 GitHub MCP
2 GH CLI
3 Serena MCP
4 Make Build
5 Playwright
6 Tavily Search
7 File Write
8 Bash Tool
9 Discussion
10 AW MCP
11 Update PR
12 Review Comments
13 Submit Review
14 Resolve Thread ⚠️
15 Add Reviewer
16 Push to Branch
17 Close PR ⚠️

Overall: PARTIAL (2 skipped, 0 failed)

💥 [THE END] — Illustrated by Smoke Claude ·

Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💥 Automated smoke test review - all systems nominal!

💥 [THE END] — Illustrated by Smoke Claude

@pelikhan pelikhan marked this pull request as ready for review March 6, 2026 08:15
Copilot AI review requested due to automatic review settings March 6, 2026 08:15
@pelikhan pelikhan merged commit d3cbe35 into main Mar 6, 2026
49 checks passed
@pelikhan pelikhan deleted the copilot/ensure-allowed-tool-filter branch March 6, 2026 08:15
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Ensures mcp-servers.allowed is propagated into the compiled MCP gateway config as the "tools" filter for all engines (not only Copilot), and adds coverage to prevent regressions.

Changes:

  • Always includes "tools" in HTTP JSON property ordering and conditionally renders it when Copilot fields are required or an explicit allowed list is present.
  • Adds an end-to-end compilation test validating mcp-servers.allowed"tools" output across several Copilot and Claude scenarios.
  • Adds a changeset to ship the fix as a patch release.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File Description
pkg/workflow/mcp_config_custom.go Updates MCP server JSON rendering to propagate allowed tool filters via the "tools" field beyond Copilot-only output.
pkg/workflow/mcp_config_compilation_test.go Adds an end-to-end compilation test verifying allowed tool filter rendering behavior.
.changeset/patch-propagate-mcp-allowed-filter.md Declares a patch release for the MCP allowed/tools propagation fix.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Comment on lines +125 to 129
// JSON format - include tools field for MCP gateway tool filtering (all engines)
// For HTTP MCP with secrets in headers, env passthrough is needed
if len(headerSecrets) > 0 {
propertyOrder = []string{"type", "url", "headers", "tools", "env"}
} else {
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment says the JSON format includes the tools field for MCP gateway tool filtering “(all engines)”, but the tools field is still conditionally rendered later (only when RequiresCopilotFields is true or when Allowed is non-empty). Consider rewording this comment to reflect the actual behavior.

Copilot uses AI. Check for mistakes.
Comment on lines +269 to +273
name: "claude - http mcp server with specific allowed tools passes through",
workflowContent: `---
on:
workflow_dispatch:
strict: false
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The scenarios here cover allowed tool compilation for Copilot (http/stdio) and Claude (http), but there isn’t a case for a non-Copilot stdio MCP server with an explicit allowed list. Adding a Claude/Gemini/Codex stdio case would better lock in the behavior from the updated tools-field inclusion gate.

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants