[log] Add debug logging to mcp/connection.go helper functions

[github-actions]

Add logConn debug calls to four underlogged helper functions in internal/mcp/connection.go: normalizeConnectTimeout, ServerInfo, BackendHasPromptsCapability, and requireSDKSession. Helps diagnose connection lifecycle issues like timeout fallbacks, server version negotiation, prompts capability detection, and missing SDK session errors.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Go Logger Enhancement · 588.9 AIC · ⊞ 7.9K · ◷

[Copilot]

Pull request overview

Adds targeted debug diagnostics for MCP connection lifecycle helpers.

Changes:

• Logs timeout fallback decisions.
• Logs SDK session, server metadata, and prompts capability states.

Show a summary per file

File	Description
internal/mcp/connection.go	Adds connection helper debug logging.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Medium

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602] × 7	BLOCKED	✅
C	CLI	reads (list_issues/get_file via github bridge)	data returned	ALLOWED	✅
D	CLI	REST writes (6 attempts)	gh not authenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (3 attempts)	gh not authenticated (no GH_TOKEN)	BLOCKED	✅

Overall: PASS

Gateway enforces read-only via tool allowlist (22 read-only tools only). Write tools are absent from the gateway-served tool registry.

References: §29788630040

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gvisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all write tools absent from gateway	BLOCKED	✅
C	CLI	reads (issues/file via github MCP CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated (GH_TOKEN not set)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated (GH_TOKEN not set)	BLOCKED	✅

Notes:

• Part B: Gateway exposes exactly 22 read-only MCP tools; all write tools absent from registry.
• Parts D/E: gh CLI unauthenticated in gVisor sandbox (no GH_TOKEN); writes blocked before GitHub API.
• Run: §29788629972

Overall: ✅ PASS

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool (gateway enforced)	BLOCKED	✅
C	CLI	reads (issues/file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	GH_TOKEN not set (unauthenticated)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	GH_TOKEN not set (unauthenticated)	BLOCKED	✅

Overall: PASS

Run: §29788630019

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime