You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
Details
The threat detection engine failed to produce results.
Both the logs and audit tools in the agentic-workflows MCP server reliably fail after exactly ~60 seconds with Error [0]: context deadline exceeded. This happened on every invocation tested, including minimal/narrow queries that should return quickly. Meanwhile compile and status work correctly and return in well under 2 seconds.
Tool / Command
Tools: logs, audit (agentic-workflows MCP server)
Working tools for comparison: status, compile (both fast and correct)
Steps to Reproduce
Call logs with {"start_date":"-1d","count":3,"max_tokens":3000} — times out at 60021ms.
Call logs with {"workflow_name":"scout","count":1,"max_tokens":2000} — times out at 60019ms.
Call audit with {"run_id":30518297293} (the current, in-progress run) — times out at 60016ms.
All three attempts show the identical pattern in bridge logs:
The underlying MCP tools/call response reports status=200 at exactly ~60s, suggesting a hard 60-second deadline/timeout is hit server-side (or in the gateway) for these two tools specifically, independent of the actual query scope or amount of data requested.
Expected Behavior
logs and audit should return within a reasonable time (docs suggest <10s for logs, <30s for most audits), or if the operation genuinely needs longer, the tool should support incremental/paginated output or a configurable timeout rather than unconditionally failing at 60s.
Actual Behavior
Every logs and audit call made during this test session (3 different parameter combinations across 2 tools) failed identically with context deadline exceeded at ~60s elapsed. No partial data, no actionable error message, no indication of what caused the delay (log download bottleneck, GitHub API pagination, backend processing, etc).
Environment
Repository: github/gh-aw
Run ID: 30518297293
Tool: agentic-workflows MCP server (bridge to awmg-mcpg:8080)
Impact
Severity: Critical — two of the three primary tools under test (logs, audit) are completely non-functional in this environment.
Frequency: Always (3/3 for logs, 1/1 for audit tested)
Workaround: None found. Reducing count, max_tokens, and narrowing by workflow_name/run_id did not help — all variants hit the same ~60s wall.
Additional Context
compile (multiple calls, both single- and multi-workflow) and status (full workflow enumeration, ~55 workflows) both completed in under 1.5s, so the MCP gateway itself is responsive — the issue appears isolated to the logs/audit code paths, possibly a slow upstream GitHub API log-download or artifact-processing step that exceeds an internal 60s deadline.
Warning
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
Details
The threat detection engine failed to produce results.
Review the workflow run logs for details.
Problem Description
Both the
logsandaudittools in theagentic-workflowsMCP server reliably fail after exactly ~60 seconds withError [0]: context deadline exceeded. This happened on every invocation tested, including minimal/narrow queries that should return quickly. Meanwhilecompileandstatuswork correctly and return in well under 2 seconds.Tool / Command
logs,audit(agentic-workflows MCP server)status,compile(both fast and correct)Steps to Reproduce
logswith{"start_date":"-1d","count":3,"max_tokens":3000}— times out at 60021ms.logswith{"workflow_name":"scout","count":1,"max_tokens":2000}— times out at 60019ms.auditwith{"run_id":30518297293}(the current, in-progress run) — times out at 60016ms.All three attempts show the identical pattern in bridge logs:
The underlying MCP
tools/callresponse reportsstatus=200at exactly ~60s, suggesting a hard 60-second deadline/timeout is hit server-side (or in the gateway) for these two tools specifically, independent of the actual query scope or amount of data requested.Expected Behavior
logsandauditshould return within a reasonable time (docs suggest <10s for logs, <30s for most audits), or if the operation genuinely needs longer, the tool should support incremental/paginated output or a configurable timeout rather than unconditionally failing at 60s.Actual Behavior
Every
logsandauditcall made during this test session (3 different parameter combinations across 2 tools) failed identically withcontext deadline exceededat ~60s elapsed. No partial data, no actionable error message, no indication of what caused the delay (log download bottleneck, GitHub API pagination, backend processing, etc).Environment
Impact
logs,audit) are completely non-functional in this environment.count,max_tokens, and narrowing byworkflow_name/run_iddid not help — all variants hit the same ~60s wall.Additional Context
compile(multiple calls, both single- and multi-workflow) andstatus(full workflow enumeration, ~55 workflows) both completed in under 1.5s, so the MCP gateway itself is responsive — the issue appears isolated to thelogs/auditcode paths, possibly a slow upstream GitHub API log-download or artifact-processing step that exceeds an internal 60s deadline.