@alfe.ai/github-mcp 0.3.0

package/dist/server.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server.js

@@ -0,0 +1,308 @@
+#!/usr/bin/env node
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { resolveConfig } from "@alfe.ai/config";
+import { AgentApiClient } from "@alfe.ai/agent-api-client";
+import { assertPatternA } from "@alfe.ai/mcp-bundler";
+//#region src/server.ts
+/**
+* GitHub MCP Proxy Server (Pattern A multi-account)
+*
+* A thin proxy that fans out to one official
+* `@modelcontextprotocol/server-github` child process per connected
+* GitHub account. Every credential-touching tool requires the LLM to
+* pass a `login` selector arg (the GitHub username); the proxy strips
+* that arg, dispatches to the right child, and returns the result.
+*
+* Pattern A locked in PR 7-deferred slice 2 of channels-and-credential-
+* driven-integrations. See `packages/mcp-bundler/DEVELOPING.md` for the
+* contract; `services/connect/DEVELOPING.md` for the provider table.
+*
+* Architecture:
+*   OpenClaw ←(stdio)→ this proxy ←(stdio fan-out)→ N × server-github
+*
+* Token model:
+*   GitHub OAuth App tokens have no expiry (`tokenLifecycle: "no_expiry"`
+*   in services/connect's GitHub provider). There is intentionally no
+*   token-refresh path — a revoked token surfaces as a 401 on the next
+*   call and the LLM can prompt the user to reconnect.
+*
+* Known caveat — child dependency:
+*   `@modelcontextprotocol/server-github` is marked deprecated upstream
+*   ("Package no longer supported"). It still works at npm install
+*   time and is the same dependency the existing GitHub integration
+*   manifest invoked directly. Migrating to a native @octokit/rest
+*   tool surface is tracked as a v2 follow-up.
+*
+* Uses the low-level Server class (not McpServer) because child tools
+* return JSON Schema objects — McpServer.registerTool requires Zod.
+*/
+const accounts = /* @__PURE__ */ new Map();
+/**
+* Full snapshot of every GitHub connection returned by getGithubAccounts(),
+* including ones we couldn't spawn a child for (e.g. missing access token
+* or spawn failure). `github_list_accounts` returns this so the LLM can
+* surface partial-failure connections instead of silently dropping them.
+*/
+const allAccountsSnapshot = [];
+/** Cached, selector-injected tool list returned to OpenClaw. */
+let cachedTools = [];
+function log(msg) {
+	process.stderr.write(`[github-mcp-proxy] ${msg}\n`);
+}
+function resolveAccount(login) {
+	if (!login) throw new Error("Missing required login argument. Call github_list_accounts to see the connected GitHub accounts and pass the login you want to target.");
+	const acct = accounts.get(login);
+	if (!acct) {
+		const known = allAccountsSnapshot.find((s) => s.login === login);
+		if (known && !known.connected) throw new Error(`login ${login} is connected on this agent but the proxy could not initialise a child server for it (reason: ${known.reason ?? "unknown"}). Ask the user to reconnect this GitHub account from the dashboard.`);
+		throw new Error(`Unknown login: ${login}. Call github_list_accounts to see the connected GitHub accounts on this agent.`);
+	}
+	return acct;
+}
+/**
+* Pin the child server-github version to match `package.json` so a future
+* upstream republish (or removal — the package is deprecated) can't
+* silently rotate the child without our knowledge. `package.json` and
+* this string must stay in sync; the openclaw-github CI runs
+* `pnpm run pin:check` (TODO post-v0.1.0) to catch drift.
+*/
+const CHILD_SERVER_GITHUB_VERSION = "2025.4.8";
+async function spawnChild(accessToken) {
+	const transport = new StdioClientTransport({
+		command: "npx",
+		args: ["-y", `@modelcontextprotocol/server-github@${CHILD_SERVER_GITHUB_VERSION}`],
+		env: {
+			...process.env,
+			GITHUB_PERSONAL_ACCESS_TOKEN: accessToken
+		}
+	});
+	const client = new Client({
+		name: "github-mcp-proxy",
+		version: "0.1.0"
+	});
+	await client.connect(transport);
+	return client;
+}
+async function killAllChildren() {
+	for (const acct of accounts.values()) try {
+		await acct.client.close();
+	} catch {}
+	accounts.clear();
+}
+/**
+* Take a tool descriptor from the child GitHub MCP server and inject a
+* required `login` string property into its inputSchema. The proxy
+* strips this arg before forwarding the call.
+*/
+function injectLoginSelector(tool) {
+	const original = tool.inputSchema ?? {};
+	const originalProperties = original.properties ?? {};
+	const originalRequired = Array.isArray(original.required) ? original.required : [];
+	const injectedProperties = {
+		...originalProperties,
+		login: {
+			type: "string",
+			description: "GitHub username (login) — use the value from github_list_accounts to pick which connected account this call should target. Tool-level `owner` arguments still target a specific repo owner; `login` selects which OAuth identity makes the API call."
+		}
+	};
+	const injectedRequired = originalRequired.includes("login") ? originalRequired : ["login", ...originalRequired];
+	return {
+		name: tool.name,
+		description: tool.description,
+		inputSchema: {
+			...original,
+			type: original.type ?? "object",
+			properties: injectedProperties,
+			required: injectedRequired
+		}
+	};
+}
+async function main() {
+	const config = resolveConfig();
+	const { accounts: connected } = await new AgentApiClient({
+		apiKey: config.apiKey,
+		apiUrl: config.apiUrl
+	}).getGithubAccounts();
+	if (connected.length === 0) log("No GitHub accounts connected — proxy will start with github_list_accounts and github_check_connection only");
+	for (const acct of connected) {
+		if (!acct.accessToken) {
+			log(`Skipping account ${acct.login} — no access token`);
+			allAccountsSnapshot.push({
+				login: acct.login,
+				displayName: acct.displayName,
+				connectedAt: acct.connectedAt,
+				connected: false,
+				reason: "missing_access_token"
+			});
+			continue;
+		}
+		if (accounts.has(acct.login)) {
+			log(`Duplicate login ${acct.login} returned by getGithubAccounts() — keeping the first cached child`);
+			continue;
+		}
+		try {
+			const client = await spawnChild(acct.accessToken);
+			accounts.set(acct.login, {
+				login: acct.login,
+				displayName: acct.displayName,
+				accessToken: acct.accessToken,
+				client
+			});
+			allAccountsSnapshot.push({
+				login: acct.login,
+				displayName: acct.displayName,
+				connectedAt: acct.connectedAt,
+				connected: true
+			});
+			log(`Spawned child server for account ${acct.login} (${acct.displayName ?? "unnamed"})`);
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			log(`Failed to spawn child for account ${acct.login}: ${message}`);
+			allAccountsSnapshot.push({
+				login: acct.login,
+				displayName: acct.displayName,
+				connectedAt: acct.connectedAt,
+				connected: false,
+				reason: `spawn_failed: ${message}`
+			});
+		}
+	}
+	const firstAccount = accounts.values().next().value;
+	if (firstAccount) {
+		const { tools } = await firstAccount.client.listTools();
+		cachedTools = tools.map(injectLoginSelector);
+		log(`Child MCP server provides ${String(cachedTools.length)} tools (selector injected)`);
+	} else {
+		cachedTools = [];
+		log("No child server available — only github_list_accounts and github_check_connection will be exposed");
+	}
+	cachedTools.push({
+		name: "github_list_accounts",
+		description: "List the GitHub accounts the agent has connected. Returns one entry per OAuth connection — use the returned login values as the `login` selector arg on every other GitHub tool.",
+		inputSchema: {
+			type: "object",
+			properties: {}
+		}
+	});
+	cachedTools.push({
+		name: "github_check_connection",
+		description: "Verify the GitHub OAuth connection for a specific connected account is still valid. Use this if GitHub API calls are failing with authentication errors. GitHub OAuth App tokens don't expire, so a failure here means the token was revoked.",
+		inputSchema: {
+			type: "object",
+			properties: { login: {
+				type: "string",
+				description: "GitHub username (login) — use the value from github_list_accounts."
+			} },
+			required: ["login"]
+		}
+	});
+	assertPatternA(cachedTools.map((t) => ({
+		name: t.name,
+		parameters: t.inputSchema
+	})), {
+		selector: "login",
+		exempt: ["github_list_accounts"]
+	});
+	const proxy = new Server({
+		name: "github-mcp-proxy",
+		version: "0.1.0"
+	}, { capabilities: { tools: {} } });
+	proxy.setRequestHandler(ListToolsRequestSchema, () => ({ tools: cachedTools }));
+	proxy.setRequestHandler(CallToolRequestSchema, async (request) => {
+		const { name, arguments: args } = request.params;
+		const argMap = args ?? {};
+		if (name === "github_list_accounts") return { content: [{
+			type: "text",
+			text: JSON.stringify({ accounts: allAccountsSnapshot }, null, 2)
+		}] };
+		if (name === "github_check_connection") try {
+			const acct = resolveAccount(typeof argMap.login === "string" ? argMap.login : void 0);
+			const response = await fetch("https://api.github.com/user", { headers: {
+				Authorization: `Bearer ${acct.accessToken}`,
+				Accept: "application/vnd.github+json",
+				"X-GitHub-Api-Version": "2022-11-28",
+				"User-Agent": "alfe-openclaw-github"
+			} });
+			if (!response.ok) return {
+				content: [{
+					type: "text",
+					text: JSON.stringify({
+						login: acct.login,
+						connected: false,
+						status: response.status,
+						error: "Token may have been revoked. Ask the user to reconnect this GitHub account from the dashboard."
+					})
+				}],
+				isError: true
+			};
+			const user = await response.json();
+			return { content: [{
+				type: "text",
+				text: JSON.stringify({
+					login: acct.login,
+					connected: true,
+					user
+				})
+			}] };
+		} catch (err) {
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify({ error: err instanceof Error ? err.message : String(err) })
+				}],
+				isError: true
+			};
+		}
+		let acct;
+		try {
+			acct = resolveAccount(typeof argMap.login === "string" ? argMap.login : void 0);
+		} catch (err) {
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify({ error: err instanceof Error ? err.message : String(err) })
+				}],
+				isError: true
+			};
+		}
+		const { login: _ignored, ...forwarded } = argMap;
+		try {
+			return await acct.client.callTool({
+				name,
+				arguments: forwarded
+			});
+		} catch (err) {
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify({
+						login: acct.login,
+						tool: name,
+						error: err instanceof Error ? err.message : String(err)
+					})
+				}],
+				isError: true
+			};
+		}
+	});
+	const transport = new StdioServerTransport();
+	await proxy.connect(transport);
+	log(`Proxy running with ${String(accounts.size)} connected account(s) and Pattern A selector enforcement`);
+}
+for (const signal of ["SIGTERM", "SIGINT"]) process.on(signal, () => {
+	killAllChildren().then(() => {
+		process.exit(0);
+	});
+});
+main().catch((err) => {
+	log(`Fatal: ${err instanceof Error ? err.message : String(err)}`);
+	killAllChildren().finally(() => {
+		process.exit(1);
+	});
+});
+//#endregion
+export {};

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@alfe.ai/github-mcp",
+  "version": "0.3.0",
+  "description": "GitHub MCP proxy server — bridges the official @modelcontextprotocol/server-github with Alfe OAuth credentials (Pattern A multi-account)",
+  "type": "module",
+  "main": "./dist/server.js",
+  "bin": {
+    "github-mcp-proxy": "./dist/server.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": ">=1.24.0",
+    "@modelcontextprotocol/server-github": "2025.4.8",
+    "@alfe.ai/config": "0.1.0",
+    "@alfe.ai/agent-api-client": "0.3.0",
+    "@alfe.ai/mcp-bundler": "0.2.1"
+  },
+  "license": "UNLICENSED",
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown --watch",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint ."
+  }
+}