You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
Details
The threat detection engine failed to produce results.
Both the logs and audit tools in the agenticworkflows MCP server consistently fail with Error [0]: context deadline exceeded after exactly ~60 seconds, for any request that would return real data (valid run ID, valid workflow name, or a broad date-range query). Meanwhile status and compile work reliably and quickly (1-2s). This effectively makes logs and audit unusable via the MCP interface.
Notably, the --timeout parameter on audit/logs appears to be ignored — passing --timeout 90 still failed at ~60s, suggesting a hardcoded internal deadline (likely on the HTTP/MCP transport or gateway) that overrides the caller-supplied value.
Call agenticworkflows logs --start_date -1d --count 3 --max_tokens 3000 → hangs for 60s, then fails.
Call agenticworkflows audit --run_id 30608937034 --max_tokens 3000 (a real, current run ID for this very execution) → hangs for 60s, then fails.
Compare with agenticworkflows audit --run_id 999999999 (an invalid run ID) → fails fast (~1s) with a clean, helpful error message. This isolates the problem to the code path that actually fetches/processes real run data (e.g. downloading logs/artifacts from GitHub Actions), not the tool dispatch itself.
Expected Behavior
logs and audit should complete within a reasonable time (per success criteria in the test plan: logs <10s, audit <30s) for valid, recent, small run IDs/workflows.
The --timeout parameter, if exposed, should be honored and allow requests to run longer if the caller explicitly requests it.
If a genuine timeout occurs, the error should be more actionable (e.g., indicate what stage timed out — log download, artifact extraction, parsing — and suggest reducing scope).
Actual Behavior
Every logs call attempted (3 variations: relative date range, specific workflow name, with explicit --timeout 90) failed identically after ~60-60.7s with:
Error [0]: context deadline exceeded
The one audit call with a valid, real run ID (this workflow's own run, 30608937034) also failed after ~60.5s with the same error.
Passing --timeout 90 had no effect — the failure still occurred at ~60s, indicating the parameter is not wired through to the actual deadline, or a shorter deadline elsewhere (proxy/gateway) takes precedence.
Environment
Repository: github/gh-aw
Run ID: 30608937034
Date: 2026-07-31
Interface: agenticworkflows MCP server via CLI bridge
Impact
Severity: Critical — two of the three primary tools under test (logs, audit) are non-functional for any real-world query.
Frequency: Always (100% reproduction rate across all variations tried).
Workaround: None found within the MCP interface. status and compile remain usable.
Logs/Diagnostics
Representative log tail (identical pattern for all 4 failing calls):
status and compile calls in the same session, against the same MCP gateway, completed normally (status: ~9s for 266 workflows; compile: 1-2s per workflow), so the MCP bridge/transport itself is functional — the issue is isolated to logs/audit specifically, likely in the log-download or artifact-fetch code path (possibly bound by a fixed ~60s deadline in the gateway/proxy layer that isn't being extended by the tool's own --timeout param).
Given this blocks all further exploratory testing of logs/audit (log content analysis, filtering edge cases, safe-output detection, failed-run analysis, etc.), Phases 2, 3, and 5/6 of the planned test session could not be completed as scoped.
Warning
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
Details
The threat detection engine failed to produce results.
Review the workflow run logs for details.
Problem Description
Both the
logsandaudittools in theagenticworkflowsMCP server consistently fail withError [0]: context deadline exceededafter exactly ~60 seconds, for any request that would return real data (valid run ID, valid workflow name, or a broad date-range query). Meanwhilestatusandcompilework reliably and quickly (1-2s). This effectively makeslogsandauditunusable via the MCP interface.Notably, the
--timeoutparameter onaudit/logsappears to be ignored — passing--timeout 90still failed at ~60s, suggesting a hardcoded internal deadline (likely on the HTTP/MCP transport or gateway) that overrides the caller-supplied value.Command/Tool
logs,audit(agenticworkflows MCP server)agenticworkflows logs --start_date -1d --count 3 --max_tokens 3000agenticworkflows logs --workflow_name daily-cli-tools-tester --count 3 --max_tokens 3000agenticworkflows logs --workflow_name daily-cli-tools-tester --count 1 --max_tokens 1000 --timeout 90agenticworkflows audit --run_id 30608937034 --max_tokens 3000Steps to Reproduce
agenticworkflows status(works fine, returns 266 workflows in ~9s).agenticworkflows compile --workflows <any-existing-workflow>(works fine, ~1-2s).agenticworkflows logs --start_date -1d --count 3 --max_tokens 3000→ hangs for 60s, then fails.agenticworkflows audit --run_id 30608937034 --max_tokens 3000(a real, current run ID for this very execution) → hangs for 60s, then fails.agenticworkflows audit --run_id 999999999(an invalid run ID) → fails fast (~1s) with a clean, helpful error message. This isolates the problem to the code path that actually fetches/processes real run data (e.g. downloading logs/artifacts from GitHub Actions), not the tool dispatch itself.Expected Behavior
logsandauditshould complete within a reasonable time (per success criteria in the test plan: logs <10s, audit <30s) for valid, recent, small run IDs/workflows.--timeoutparameter, if exposed, should be honored and allow requests to run longer if the caller explicitly requests it.Actual Behavior
logscall attempted (3 variations: relative date range, specific workflow name, with explicit--timeout 90) failed identically after ~60-60.7s with:auditcall with a valid, real run ID (this workflow's own run, 30608937034) also failed after ~60.5s with the same error.--timeout 90had no effect — the failure still occurred at ~60s, indicating the parameter is not wired through to the actual deadline, or a shorter deadline elsewhere (proxy/gateway) takes precedence.Environment
Impact
logs,audit) are non-functional for any real-world query.statusandcompileremain usable.Logs/Diagnostics
Representative log tail (identical pattern for all 4 failing calls):
Additional Context
statusandcompilecalls in the same session, against the same MCP gateway, completed normally (status: ~9s for 266 workflows; compile: 1-2s per workflow), so the MCP bridge/transport itself is functional — the issue is isolated tologs/auditspecifically, likely in the log-download or artifact-fetch code path (possibly bound by a fixed ~60s deadline in the gateway/proxy layer that isn't being extended by the tool's own--timeoutparam).logs/audit(log content analysis, filtering edge cases, safe-output detection, failed-run analysis, etc.), Phases 2, 3, and 5/6 of the planned test session could not be completed as scoped.