[guard-coverage] Guard coverage gap: 1 operations from github-mcp-server / GitHub CLI not fully covered

[github-actions]

Summary

The GitHub guard does not fully cover 1 operation from the github-mcp-server and/or GitHub CLI. This can leave a mutating operation unclassified and unlabeled for DIFC.

• MCP tools scanned: 89
• CLI write commands scanned: 81
• Guard-covered write tools (tools.rs): 128
• Tools with explicit DIFC rules (tool_rules.rs): 130
• New gaps found this run: 1

---

MCP Tool Classification Gaps (tools.rs)

These MCP tools perform write or mutating operations but are missing from WRITE_OPERATIONS or READ_WRITE_OPERATIONS in guards/github-guard/rust-guard/src/tools.rs:

Tool Name	Operation Type	Suggested Classification	Notes
assign_copilot_to_issue_with_intent	write	WRITE_OPERATIONS	Remote GitHub MCP tool that records Copilot assignment intent and may launch the assignment when is_suggestion=false; it is listed in the upstream README but absent from the local guard lists.

Suggested fix for tools.rs

pub const WRITE_OPERATIONS: &[&str] = &[
    // ... existing entries ...
    "assign_copilot_to_issue",
    "assign_copilot_to_issue_with_intent", // upstream Copilot intent assignment write
    "cancel_workflow_run",
    // ... existing entries ...
];

---

MCP Tool DIFC Labeling Gaps (tool_rules.rs)

These MCP tools exist in the upstream server but have no explicit match arm in apply_tool_labels in guards/github-guard/rust-guard/src/labels/tool_rules.rs:

Tool Name	Data Scope	Suggested Labels	Risk
assign_copilot_to_issue_with_intent	repo-scoped	secrecy: S(repo), integrity: writer	Medium

Suggested fix for tool_rules.rs

Add assign_copilot_to_issue_with_intent to the existing repo-scoped write arm next to assign_copilot_to_issue and request_copilot_review:

        | "assign_copilot_to_issue"
        | "assign_copilot_to_issue_with_intent"
        | "request_copilot_review"

This tool should inherit the same repo-visibility secrecy and writer integrity handling already applied to the neighboring Copilot write tools.

---

GitHub CLI-Only Gaps

No new CLI-only gaps were found in the inspected mutating command set. The current synthetic entries and lock/unlock write-pattern coverage accounted for the CLI operations reviewed in this run.

---

Stale Guard Entries (bonus)

No new stale guard entries were identified after excluding intentional synthetic/internal guard entries.

---

References

• github-mcp-server tools
• GitHub CLI commands
• guard tools.rs
• guard tool_rules.rs
• Run: 29887829012

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by GitHub Guard Coverage Checker (MCP + CLI) · 121.9 AIC · ⊞ 26.2K · ◷

• expires on Aug 5, 2026, 3:18 AM UTC

[github-actions]

🤖 This is an automated response from Repo Assist.

I've submitted a draft PR (#aw_ra_guard_intent_pr) to address this gap.

The fix adds assign_copilot_to_issue_with_intent to WRITE_OPERATIONS in tools.rs (alphabetically between its sibling and cancel_workflow_run) and to the Copilot write arm in tool_rules.rs (next to assign_copilot_to_issue and request_copilot_review). All 596 Rust guard tests pass.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by Repo Assist · 91.6 AIC · ⊞ 11.1K · ◷
_{Comment /repo-assist to run again}

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@851905c06e905bf362a9f6cc54f912e3df747d55