Enable repository delegation in unified MCP gateway mode by Copilot · Pull Request #12753 · github/gh-aw-mcpg

Copilot · 2026-09-08T15:41:56Z

github-repository-delegation-v1 only initialized in proxy mode, leaving gh-aw’s unified gateway without the private control listener even when all delegation activation inputs were present. AWF could receive a control endpoint, but reconciliation failed because no controller was serving it.

Unified delegation activation
- Resolve the existing five delegation environment inputs during normal gateway startup.
- Fail startup on partial or malformed activation instead of silently running without delegation.
- Attach the resolved delegation store to the unified server config.
Private control plane
- Start the delegation control listener alongside the unified MCP gateway.
- Expose the existing status, reconcile, create-or-confirm, revoke, and revoke-by-labels operations through the private control endpoint.
- Shut down the control listener with the gateway and persist delegation state.
Delegated /mcp/github data plane
- Admit live delegated executor bearers through gateway auth without treating them as control credentials.
- Authorize delegated tool calls against the shared store before backend execution.
- Restrict delegated bearers to the exact bound owner/repo and closed github-repository-read-v1 tool set.

ctx, err := us.authorizeDelegatedToolCall(ctx, serverID, toolName, args)
if err != nil {
    return mcp.NewErrorCallToolResult(err)
}

Fixes Enable repository delegation in unified MCP gateway mode #12752

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

lpcox · 2026-09-08T16:00:50Z

@copilot fix the linting errors https://github.com/github/gh-aw-mcpg/actions/runs/34247413409/job/102135837990?pr=12753

Copilot

🟡 Changes recommended

Delegated calls can bypass revocation without gateway keys and fail under per-agent policies, while required integration coverage is absent.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Enables repository delegation in unified MCP gateway mode by sharing delegation state across control and data planes.

Changes:

Initializes delegation during unified startup and serves the private control API.
Authenticates and authorizes delegated GitHub tool calls.
Adds shared delegation configuration and unit coverage.

File summaries

File	Description
`internal/server/unified.go`	Attaches delegation runtime state.
`internal/server/middleware.go`	Adds delegated authentication.
`internal/server/middleware_auth.go`	Accepts live executor bearers.
`internal/server/delegation.go`	Implements control and authorization logic.
`internal/server/delegation_test.go`	Tests delegated calls and authentication.
`internal/server/backend_call.go`	Authorizes calls before execution.
`internal/proxy/delegation.go`	Reuses shared delegation configuration.
`internal/delegation/store.go`	Detects live executor bearers.
`internal/delegation/store_test.go`	Tests bearer revocation handling.
`internal/delegation/config.go`	Defines shared runtime configuration.
`internal/config/config_core.go`	Adds delegation to gateway configuration.
`internal/cmd/root.go`	Starts and stops unified delegation services.
`internal/cmd/proxy.go`	Returns shared runtime configuration.
`internal/cmd/delegation.go`	Manages the unified control listener.
`internal/cmd/delegation_test.go`	Tests control-listener status.

Review details

Files reviewed: 15/15 changed files
Comments generated: 3
Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+func applyAuthIfConfiguredWithDelegation(apiKeys []string, delegatedAuthenticator func(string) bool, handler http.HandlerFunc) http.HandlerFunc {
 	if len(apiKeys) > 0 {
 		logAuth.Print("Auth key configured, applying middleware")
-		return authMiddleware(apiKeys, handler)
+		return authMiddlewareWithDelegation(apiKeys, delegatedAuthenticator, handler)


 	}()

 	sessionID := us.getSessionID(ctx)
+	ctx, err := us.authorizeDelegatedToolCall(ctx, serverID, toolName, args)


+	"github.com/stretchr/testify/require"
+)
+
+func TestStartUnifiedDelegationControlServesStatus(t *testing.T) {


Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

lpcox

Requesting changes because the unified controller now starts, but the delegated data plane is still unusable under the exact gh-aw configuration and admits capabilities outside the closed delegation policy.

Before merge, add a real root-command integration test that launches the config-stdin unified mode with all five delegation environment inputs, the private listener, and AgentPolicies exactly as gh-aw emits them. Exercise status, reconcile, create-or-confirm, revoke, and revoke-by-labels over the control port; use the minted bearer through /mcp/github for an allowed call; prove denial for other repositories, tools, and non-tool MCP capabilities; then verify revocation and restart/recovery behavior.

The prior CI runs reported three testifylint failures. Head d7955c7 is specifically intended to fix those diagnostics, so the refreshed head still needs a green lint rerun.

lpcox · 2026-09-08T16:11:40Z

@copilot address all review feedback

Copilot · 2026-09-08T16:12:57Z

@copilot fix the linting errors https://github.com/github/gh-aw-mcpg/actions/runs/34247413409/job/102135837990?pr=12753

Fixed in d7955c7. The referenced testifylint errors are resolved, and validation passed with go test ./internal/cmd ./internal/server, golangci-lint v2.13.2, and make agent-finished.

Copilot · 2026-09-08T16:15:30Z

@copilot fix the linting errors https://github.com/github/gh-aw-mcpg/actions/runs/34247413409/job/102135837990?pr=12753

Verified at d7955c7: the referenced testifylint diagnostics are cleared locally with golangci-lint run --timeout=5m using v2.13.2 (0 issues).

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-09-08T16:33:38Z

@copilot address all review feedback

Addressed in c58599e. The current branch carries the delegated authorization through the static AgentPolicies check only after store authorization, exposes delegated sessions through a filtered github-repository-read-v1 tool surface, rejects non-tool delegated MCP methods, and adds root-command integration coverage for control operations, allowed/denied calls, expiry, revocation replay, restart persistence, and partial activation failure. Validation passed with targeted delegation tests, golangci-lint run --timeout=5m, and make agent-finished.

lpcox · 2026-09-08T16:43:55Z

@copilot address the review feedback #12753 (comment)

…nd listener-conflict coverage Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-09-08T16:53:44Z

@copilot address the review feedback #12753 (comment)

Addressed — see the reply on the linked discussion thread and the latest commit for the fix and added test coverage.

github-actions · 2026-09-08T16:58:48Z

🔒 mcpg Read-Only Stress — gvisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gvisor

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data (list_issues, list_pull_requests, get_file_contents, list_commits)	ALLOWED	✅
B	MCP	writes (issue_write etc.)	all 7 targets absent from the 23-tool read-only catalog (e.g. `issue_write` -> "unknown tool")	BLOCKED	⚠️
C	CLI	reads (proxied `github` CLI on PATH)	data returned for all reads	ALLOWED	✅
D	CLI	REST writes	`gh` unauthenticated in this sandbox (`gh auth status`: not logged in; `gh api` requires GH_TOKEN) — no write attempted	BLOCKED	⚠️
E	CLI	GraphQL mutations	same auth gap as D — not attempted	BLOCKED	⚠️

Overall: INCONCLUSIVE

No write leaked. Part B could not distinguish gateway-level enforcement from backend GITHUB_READ_ONLY=1 config since all write-tool targets were absent from the exposed tool catalog entirely (gh-aw's tools.github: always forces read-only backend). Parts D/E could not be exercised because gh CLI has no credentials in this environment. Read-only holds identically to the default runtime, but full gateway-level write-blocking evidence for gvisor requires follow-up work (dedicated MCP-tool probe outside tools.github: wrapper, and an authenticated gh token for REST/GraphQL write tests).

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

github-actions · 2026-09-08T16:59:50Z

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (add_issue_comment/star_repository/issue_write/create_branch/create_or_update_file/create_pull_request)	all 6 write tools absent from catalog	BLOCKED	⚠️
C	CLI	reads (proxied `github` CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	`gh` unauthenticated, not attempted	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	`gh` unauthenticated, not attempted	BLOCKED	⚠️

Overall: INCONCLUSIVE

Notes:

Only 23 read-only tools are exposed by the gateway-backed github MCP/CLI proxy (get_, list_, search_*, issue_read, pull_request_read); none of the 6 targeted write tools exist in the catalog, so no write attempt ever reached a write-capable backend to independently test mcpg's own DIFC/guard layer (per gh-aw's GITHUB_READ_ONLY=1 design). This confirms backend/toolset configuration but not the gateway's own blocking layer.
gh CLI had no GH_TOKEN set in this environment (You are not logged into any GitHub hosts), so Parts D and E could not be exercised at all — no writes attempted, no leak.
No reactions, stars, issues, comments, branches, files, or PRs were created during this run.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

lpcox

Verified on head bd2fe68. The dynamic-policy bypass is limited to calls already authorized by the delegation store, non-tool and malformed/batched JSON-RPC requests fail closed, and the root-command integration coverage now exercises the control/data-plane boundary, credential separation, listener failure, revocation, and restart persistence. Full local completion and integration suites pass.

Initial plan

e9833fc

Copilot AI assigned Copilot and lpcox Sep 8, 2026

Copilot started work on behalf of lpcox September 8, 2026 15:42 View session

Copilot AI linked an issue Sep 8, 2026 that may be closed by this pull request

Enable repository delegation in unified MCP gateway mode #12752

Closed

enable delegation in unified gateway mode

096393c

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add support for repository delegation in unified MCP gateway mode~~ Enable repository delegation in unified MCP gateway mode Sep 8, 2026

Copilot AI requested a review from lpcox September 8, 2026 15:56

Copilot finished work on behalf of lpcox September 8, 2026 15:56

lpcox marked this pull request as ready for review September 8, 2026 15:59

Copilot AI balanced review requested due to automatic review settings September 8, 2026 15:59

Copilot started reviewing on behalf of lpcox September 8, 2026 16:00 View session

This comment has been minimized.

Sign in to view

Copilot AI reviewed Sep 8, 2026

View reviewed changes

Copilot started work on behalf of lpcox September 8, 2026 16:06 View session

fix delegation test lint errors

d7955c7

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

lpcox requested changes Sep 8, 2026

View reviewed changes

Comment thread internal/server/delegation.go Outdated

Comment thread internal/server/middleware.go Outdated

Copilot started work on behalf of lpcox September 8, 2026 16:11 View session

Copilot finished work on behalf of lpcox September 8, 2026 16:13

Copilot AI requested a review from lpcox September 8, 2026 16:13

Fix delegated unified policy enforcement

c58599e

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox September 8, 2026 16:27

Copilot started work on behalf of lpcox September 8, 2026 16:28 View session

lpcox closed this Sep 8, 2026

lpcox reopened this Sep 8, 2026

Copilot finished work on behalf of lpcox September 8, 2026 16:34

Copilot started work on behalf of lpcox September 8, 2026 16:44 View session

Fail closed for delegated JSON-RPC batches; add cross-use, restart, a…

bd2fe68

…nd listener-conflict coverage Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox September 8, 2026 16:54

lpcox approved these changes Sep 8, 2026

View reviewed changes

lpcox merged commit 6940ffe into main Sep 8, 2026
37 of 38 checks passed

lpcox deleted the copilot/enable-repository-delegation branch September 8, 2026 17:10

Uh oh!

Conversation

Copilot AI commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lpcox commented Sep 8, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

lpcox left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

lpcox commented Sep 8, 2026

Uh oh!

Copilot AI commented Sep 8, 2026

Uh oh!

Copilot AI commented Sep 8, 2026

Uh oh!

Copilot AI commented Sep 8, 2026

Uh oh!

lpcox commented Sep 8, 2026

Uh oh!

Copilot AI commented Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 8, 2026

🔒 mcpg Read-Only Stress — gvisor

Uh oh!

github-actions Bot commented Sep 8, 2026

🔒 mcpg Read-Only Stress — default

Uh oh!

lpcox left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Sep 8, 2026 •

edited

Loading