mcp-github-crunchtools 1.6.0__tar.gz → 2.0.1__tar.gz

{mcp_github_crunchtools-1.6.0 → mcp_github_crunchtools-2.0.1}/.github/workflows/constitution.yml

@@ -18,4 +18,4 @@ permissions:
 jobs:
   constitution:
     name: Constitution
-    uses: crunchtools/constitution/.github/workflows/validate.yml@v1.24.0
+    uses: crunchtools/constitution/.github/workflows/validate.yml@v1.28.0

{mcp_github_crunchtools-1.6.0 → mcp_github_crunchtools-2.0.1}/.github/workflows/dependabot-automerge.yml

@@ -15,4 +15,4 @@ permissions:
 jobs:
   automerge:
     name: Dependabot
-    uses: crunchtools/constitution/.github/workflows/dependabot-automerge.yml@v1.24.0
+    uses: crunchtools/constitution/.github/workflows/dependabot-automerge.yml@v1.28.0

mcp_github_crunchtools-2.0.1/.github/workflows/security.yml

@@ -0,0 +1,68 @@
+name: Security Scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Run every Monday at 9 AM UTC
+    - cron: "0 9 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+  security-events: write
+
+jobs:
+  dependency-audit:
+    name: Dependency CVE Scan
+    permissions:
+      contents: read
+      issues: write
+    uses: crunchtools/constitution/.github/workflows/dependency-audit.yml@v1.28.0
+
+  container-scan:
+    name: Container Security Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Build container image
+        run: |
+          docker build -f Containerfile -t mcp-github:scan .
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: "mcp-github:scan"
+          format: "sarif"
+          output: "trivy-results.sarif"
+          severity: "CRITICAL,HIGH"
+
+      - name: Upload Trivy scan results
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: "trivy-results.sarif"
+
+  codeql:
+    name: CodeQL Analysis
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: python
+          queries: security-extended
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:python"

{mcp_github_crunchtools-1.6.0 → mcp_github_crunchtools-2.0.1}/.pre-commit-config.yaml

@@ -12,7 +12,7 @@ repos:
         types: [python]
         stages: [pre-commit, pre-merge-commit]
   - repo: https://github.com/crunchtools/constitution
-    rev: v1.24.0
+    rev: v1.28.0
     hooks:
       - id: validate-constitution
 

{mcp_github_crunchtools-1.6.0 → mcp_github_crunchtools-2.0.1}/.specify/memory/constitution.md

@@ -4,7 +4,7 @@
 > **Ratified:** 2026-06-14
 > **Amended:** 2026-10-14
 > **Status:** Active
-> **Inherits:** [crunchtools/constitution](https://github.com/crunchtools/constitution) v1.24.0
+> **Inherits:** [crunchtools/constitution](https://github.com/crunchtools/constitution) v1.28.0
 > **Profile:** MCP Server
 
 This file holds what is specific to mcp-github. The fleet rules and the MCP

{mcp_github_crunchtools-1.6.0 → mcp_github_crunchtools-2.0.1}/CHANGELOG.md

@@ -6,6 +6,35 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [2.0.1] - 2026-10-31
+
+### Security
+
+- Upgraded locked dependencies within their declared ranges to clear the
+  advisories the fleet dependency audit found (anyio, authlib, cryptography, dnspython, joserfc, opentelemetry-api, pydantic-settings, pyjwt).
+
+## [2.0.0] - 2026-10-30
+
+### Changed
+
+- **Breaking:** `get_failed_job_logs_tool` no longer returns the raw log tail
+  (`log`/`log_lines`) by default. Each failed job now carries a
+  `failure_summary` instead — the tail lines that name the cause (error
+  annotations, test failures, tracebacks, non-zero exits), with
+  `summary_lines`. A failed job's log can run to the byte cap and, for a
+  repository whose CI quotes attack corpora (e.g. a prompt-injection defense
+  project), a scanning gateway may flag and withhold the whole tail, leaving
+  the operator unable to see why CI failed. The distilled summary is small and
+  signal-only, so it is far more likely to pass such a gateway. Pass
+  `include_raw_log=true` to also get the full cleaned tail as `log`/`log_lines`,
+  exactly as before (that path is what a gateway may still withhold). The
+  summary counts against the same 256 KiB result budget as the raw tail.
+
+### Added
+
+- `get_failed_job_logs_tool` gains an `include_raw_log` parameter (default
+  `false`).
+
 ## [1.6.0] - 2026-10-20
 
 ### Changed

{mcp_github_crunchtools-1.6.0 → mcp_github_crunchtools-2.0.1}/Containerfile

@@ -27,7 +27,7 @@ FROM quay.io/hummingbird/python:3.14
 
 # Labels for container metadata
 LABEL name="mcp-github-crunchtools" \
-      version="1.6.0" \
+      version="2.0.1" \
       summary="Secure MCP server for GitHub issues, pull requests, Actions, releases, files, and search" \
       description="A security-focused MCP server for GitHub built on Red Hat UBI" \
       maintainer="crunchtools.com" \

{mcp_github_crunchtools-1.6.0 → mcp_github_crunchtools-2.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcp-github-crunchtools
-Version: 1.6.0
+Version: 2.0.1
 Summary: Secure MCP server for GitHub issues, pull requests, Actions, releases, files, and search
 Author: crunchtools.com
 License-Expression: AGPL-3.0-or-later
@@ -95,7 +95,7 @@ permission the tool needs (see [Token permissions](#token-permissions)).
 |------|--------------|------------|
 | `list_workflow_runs_tool` | List workflow runs, filtered by branch or status | Actions: read |
 | `get_workflow_run_tool` | One run's status, conclusion, head SHA and jobs (no logs) | Actions: read |
-| `get_failed_job_logs_tool` | The last lines of the log of each failed job in a run, with ANSI escapes and timestamps removed | Actions: read |
+| `get_failed_job_logs_tool` | A failure summary (the cause lines) of each failed job in a run; the raw log tail with `include_raw_log` | Actions: read |
 | `trigger_workflow_tool` | Start a fresh run via `workflow_dispatch` (*write*) | Actions: write |
 | `rerun_workflow_run_tool` | Re-run every job of a run (*write*) | Actions: write |
 | `rerun_failed_jobs_tool` | Re-run only the failed jobs of a run (*write*) | Actions: write |
@@ -130,12 +130,16 @@ permission the tool needs (see [Token permissions](#token-permissions)).
   `pagination.next_page` for more.
 - `get_workflow_run_tool` lists up to 300 jobs; `jobs_truncated` says when the
   run has more.
-- `get_failed_job_logs_tool` returns at most 1000 lines per job (200 by
-  default), for at most 5 failed jobs, and at most 256 KiB of log text in
-  all, split evenly between the jobs. `tail_lines` in the result is the value
-  actually used, `failed_jobs_omitted` counts the jobs left out, and
-  `truncated` is set on a job whose log was cut short and on the result when
-  anything was. Only the first 300 jobs of a run are examined;
+- `get_failed_job_logs_tool` returns a `failure_summary` per job by default —
+  the tail lines that name the cause (error annotations, test failures,
+  tracebacks, non-zero exits) — scanning at most 1000 lines per job (200 by
+  default), for at most 5 failed jobs, and at most 256 KiB of log text in all,
+  split evenly between the jobs. Pass `include_raw_log=true` to also get the
+  full cleaned tail as `log`/`log_lines`; a scanning gateway may withhold that
+  raw tail where it delivers the summary. `tail_lines` in the result is the
+  value actually used, `failed_jobs_omitted` counts the jobs left out, and
+  `truncated` is set on a job whose log or summary was cut and on the result
+  when anything was. Only the first 300 jobs of a run are examined;
   `jobs_truncated` says when the run has more, and the counts then cover only
   those.
 

{mcp_github_crunchtools-1.6.0 → mcp_github_crunchtools-2.0.1}/README.md

@@ -69,7 +69,7 @@ permission the tool needs (see [Token permissions](#token-permissions)).
 |------|--------------|------------|
 | `list_workflow_runs_tool` | List workflow runs, filtered by branch or status | Actions: read |
 | `get_workflow_run_tool` | One run's status, conclusion, head SHA and jobs (no logs) | Actions: read |
-| `get_failed_job_logs_tool` | The last lines of the log of each failed job in a run, with ANSI escapes and timestamps removed | Actions: read |
+| `get_failed_job_logs_tool` | A failure summary (the cause lines) of each failed job in a run; the raw log tail with `include_raw_log` | Actions: read |
 | `trigger_workflow_tool` | Start a fresh run via `workflow_dispatch` (*write*) | Actions: write |
 | `rerun_workflow_run_tool` | Re-run every job of a run (*write*) | Actions: write |
 | `rerun_failed_jobs_tool` | Re-run only the failed jobs of a run (*write*) | Actions: write |
@@ -104,12 +104,16 @@ permission the tool needs (see [Token permissions](#token-permissions)).
   `pagination.next_page` for more.
 - `get_workflow_run_tool` lists up to 300 jobs; `jobs_truncated` says when the
   run has more.
-- `get_failed_job_logs_tool` returns at most 1000 lines per job (200 by
-  default), for at most 5 failed jobs, and at most 256 KiB of log text in
-  all, split evenly between the jobs. `tail_lines` in the result is the value
-  actually used, `failed_jobs_omitted` counts the jobs left out, and
-  `truncated` is set on a job whose log was cut short and on the result when
-  anything was. Only the first 300 jobs of a run are examined;
+- `get_failed_job_logs_tool` returns a `failure_summary` per job by default —
+  the tail lines that name the cause (error annotations, test failures,
+  tracebacks, non-zero exits) — scanning at most 1000 lines per job (200 by
+  default), for at most 5 failed jobs, and at most 256 KiB of log text in all,
+  split evenly between the jobs. Pass `include_raw_log=true` to also get the
+  full cleaned tail as `log`/`log_lines`; a scanning gateway may withhold that
+  raw tail where it delivers the summary. `tail_lines` in the result is the
+  value actually used, `failed_jobs_omitted` counts the jobs left out, and
+  `truncated` is set on a job whose log or summary was cut and on the result
+  when anything was. Only the first 300 jobs of a run are examined;
   `jobs_truncated` says when the run has more, and the counts then cover only
   those.
 

{mcp_github_crunchtools-1.6.0 → mcp_github_crunchtools-2.0.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mcp-github-crunchtools"
-version = "1.6.0"
+version = "2.0.1"
 description = "Secure MCP server for GitHub issues, pull requests, Actions, releases, files, and search"
 requires-python = ">=3.10"
 license = "AGPL-3.0-or-later"

{mcp_github_crunchtools-1.6.0 → mcp_github_crunchtools-2.0.1}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/crunchtools/mcp-github",
     "source": "github"
   },
-  "version": "1.6.0",
+  "version": "2.0.1",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "mcp-github-crunchtools",
-      "version": "1.6.0",
+      "version": "2.0.1",
       "transport": {
         "type": "stdio"
       }

{mcp_github_crunchtools-1.6.0 → mcp_github_crunchtools-2.0.1}/src/mcp_github_crunchtools/__init__.py

@@ -29,7 +29,7 @@ import argparse
 
 from .server import mcp
 
-__version__ = "1.6.0"
+__version__ = "2.0.1"
 __all__ = ["main", "mcp"]
 
 

{mcp_github_crunchtools-1.6.0 → mcp_github_crunchtools-2.0.1}/src/mcp_github_crunchtools/server.py

@@ -46,7 +46,7 @@ READ_ONLY = {"readOnlyHint": True}
 
 mcp = FastMCP(
     name="mcp-github",
-    version="1.6.0",
+    version="2.0.1",
     instructions=(
         "Secure MCP server for GitHub repositories: issues, pull requests "
         "(open, review discussion, diffs, CI checks, merge), Actions runs and "
@@ -713,33 +713,45 @@ async def get_failed_job_logs_tool(
     run_id: Annotated[int, Field(ge=1)],
     tail_lines: int = 200,
     owner: str | None = None,
+    include_raw_log: bool = False,
 ) -> dict[str, Any]:
-    """Get the end of the log of each failed job in a GitHub Actions run.
+    """Get the failure summary of each failed job in a GitHub Actions run.
 
-    Returns the last ``tail_lines`` lines of every job that failed or timed
-    out, with ANSI escapes and timestamps removed, and the names of the steps
-    that failed. Logs are fetched for at most 5 failed jobs and all log text
-    together is capped at 256 KiB; ``truncated`` and ``failed_jobs_omitted``
-    say when something was cut. ``jobs_truncated`` means the run has more than
-    the 300 jobs examined, so the failed-job counts cover only those.
+    Returns, for every job that failed or timed out, a ``failure_summary``: the
+    log-tail lines that name the cause (error annotations, test failures,
+    tracebacks, non-zero exits), with ANSI escapes and timestamps removed, plus
+    the names of the steps that failed. Set ``include_raw_log`` to also get the
+    full cleaned tail as ``log`` — it can be large and, for a repository whose
+    CI output quotes attack corpora, a scanning gateway may flag and withhold
+    it, where the small, signal-only summary is far more likely to pass.
+
+    Logs are fetched for at most 5 failed jobs and all log text together is
+    capped at 256 KiB; ``truncated`` and ``failed_jobs_omitted`` say when
+    something was cut. ``jobs_truncated`` means the run has more than the 300
+    jobs examined, so the failed-job counts cover only those.
 
     Args:
         repo: Repository name
         run_id: Workflow run ID
-        tail_lines: Lines to return from the end of each log (default 200,
-            max 1000)
+        tail_lines: Lines of the tail to scan for the summary, and to return as
+            ``log`` when ``include_raw_log`` is set (default 200, max 1000)
         owner: Repository owner (defaults to GITHUB_DEFAULT_ORG if unset)
+        include_raw_log: Also return the full cleaned tail as ``log`` (default
+            False); the raw tail may be withheld by a scanning gateway, the
+            summary is not
 
     Returns:
         {"run_id", "tail_lines", "failed_job_count", "failed_jobs_omitted",
         "jobs_truncated", "truncated", "jobs": [{"id", "name", "conclusion",
-        "html_url", "failed_steps", "log", "log_lines", "truncated"}]}
+        "html_url", "failed_steps", "failure_summary", "summary_lines",
+        "truncated", and "log"/"log_lines" when include_raw_log}]}
     """
     return await get_failed_job_logs(
         owner=owner,
         repo=repo,
         run_id=run_id,
         tail_lines=tail_lines,
+        include_raw_log=include_raw_log,
     )
 
 

{mcp_github_crunchtools-1.6.0 → mcp_github_crunchtools-2.0.1}/src/mcp_github_crunchtools/tools/actions.py

@@ -306,38 +306,101 @@ def _tail_log(download: dict[str, Any], tail_lines: int, max_bytes: int) -> dict
     }
 
 
+_SUMMARY_MAX_LINES = 60
+_SUMMARY_MAX_BYTES = 16 * 1024
+
+#: Lines that carry a failure's cause rather than the output around it. A failed
+#: job's log can run to the byte cap and, in a security repo, quote attack
+#: corpora verbatim; the distilled summary is what an operator needs to see the
+#: cause and is small enough that a scanning gateway delivers it, where the raw
+#: tail is flagged and withheld. Each cleaned line is tested on its own, so ``^``
+#: anchors that line.
+_FAILURE_SIGNAL = re.compile(
+    r"(?i)"
+    r"\#\#\[error\]|::error|"  # GitHub Actions error annotations
+    r"\bFAIL(?:ED|URE)?\b|\bERRORS?\b|"  # test/build failure words
+    r"^E\s|"  # pytest assertion detail line
+    r"Traceback \(most recent call last\)|"
+    r"\b\w*(?:Error|Exception):|\bassert\b|"
+    r"short test summary|={3,} FAILURES|={3,} ERRORS|"
+    r"Process completed with exit code|exited with (?:code )?\d|"
+    r"npm ERR!|make: \*\*\*"
+)
+
+
+def _failure_summary(log_text: str) -> dict[str, Any]:
+    """Pull the failure-signal lines out of a cleaned log tail.
+
+    Keeps only the lines that name the cause (error annotations, test failures,
+    tracebacks, non-zero exits), newest first dropped last, capped at
+    ``_SUMMARY_MAX_LINES`` and ``_SUMMARY_MAX_BYTES``. This is what a caller gets
+    by default; the raw tail is behind ``include_raw_log`` because it can run
+    long and, for a security repo, quotes attack payloads a scanning gateway
+    may flag and withhold. Being small and signal-only, the summary is far more
+    likely to pass such a gateway than the raw tail; whether it does is the
+    gateway's call, not this tool's.
+    """
+    hits = [line for line in log_text.split("\n") if line and _FAILURE_SIGNAL.search(line)]
+    kept = hits[-_SUMMARY_MAX_LINES:]
+    truncated = len(kept) < len(hits)
+    text = "\n".join(kept)
+
+    encoded = text.encode()
+    if len(encoded) > _SUMMARY_MAX_BYTES:
+        truncated = True
+        kept_bytes = encoded[-_SUMMARY_MAX_BYTES:].decode("utf-8", errors="ignore")
+        text = kept_bytes.partition("\n")[2] or kept_bytes
+
+    return {
+        "failure_summary": text,
+        "summary_lines": text.count("\n") + 1 if text else 0,
+        "summary_truncated": truncated,
+    }
+
+
 async def get_failed_job_logs(
     owner: str | None,
     repo: str,
     run_id: int,
     tail_lines: int = DEFAULT_LOG_TAIL_LINES,
+    include_raw_log: bool = False,
 ) -> dict[str, Any]:
     """Get the end of the log of each failed job in a workflow run.
 
     A job counts as failed when its conclusion is "failure" or "timed_out".
-    For each, the last ``tail_lines`` lines of its log are returned with ANSI
-    escapes and the per-line timestamps removed, along with the names of the
-    steps that failed.
+    For each, a ``failure_summary`` is returned by default: the lines of the log
+    tail that name the cause (error annotations, test failures, tracebacks,
+    non-zero exits), with ANSI escapes and per-line timestamps removed, along
+    with the names of the steps that failed. The full ``tail_lines``-line tail
+    is returned as ``log`` only when ``include_raw_log`` is set — it can run to
+    the byte cap and, for a repository whose CI quotes attack corpora, a
+    scanning gateway may flag and withhold it, where the small, signal-only
+    summary is far more likely to pass.
 
     Limits, each reported in the result when it applies: ``tail_lines`` is
     capped at 1000 (the value used is returned); logs are fetched for at most
     5 failed jobs (``failed_jobs_omitted`` counts the rest); and all log text
     together stays within 256 KiB, split evenly between the jobs (a job whose
-    log was cut short of ``tail_lines`` has ``truncated`` set). Only the first
-    300 jobs of a run are examined: when ``jobs_truncated`` is set the run has
-    more, and the failed-job counts cover only those examined.
+    log or summary was cut has ``truncated`` set). Only the first 300 jobs of a
+    run are examined: when ``jobs_truncated`` is set the run has more, and the
+    failed-job counts cover only those examined.
 
     Args:
         owner: Repository owner (defaults to GITHUB_DEFAULT_ORG if unset)
         repo: Repository name
         run_id: Workflow run ID
-        tail_lines: Lines to return from the end of each log (default 200,
+        tail_lines: Lines of the raw tail to scan for the summary, and to
+            return as ``log`` when ``include_raw_log`` is set (default 200,
             max 1000)
+        include_raw_log: Also return the full cleaned tail as ``log`` (default
+            False). The raw tail may be withheld by a scanning gateway; the
+            summary is not.
 
     Returns:
         {"run_id", "tail_lines", "failed_job_count", "failed_jobs_omitted",
         "jobs_truncated", "truncated", "jobs": [{"id", "name", "conclusion",
-        "html_url", "failed_steps", "log", "log_lines", "truncated"}]}
+        "html_url", "failed_steps", "failure_summary", "summary_lines",
+        "truncated", and "log"/"log_lines" when include_raw_log}]}
     """
     owner = resolve_owner(owner)
     repo = validate_name(repo, "repo")
@@ -358,20 +421,33 @@ async def get_failed_job_logs(
             f"/repos/{owner}/{repo}/actions/jobs/{job_id}/logs",
             tail_bytes=MAX_LOG_TOTAL_BYTES,
         )
-        results.append(
-            {
-                "id": job_id,
-                "name": job.get("name"),
-                "conclusion": job.get("conclusion"),
-                "html_url": job.get("html_url"),
-                "failed_steps": [
-                    step.get("name")
-                    for step in job.get("steps") or []
-                    if step.get("conclusion") in FAILED_JOB_CONCLUSIONS
-                ],
-                **_tail_log(download, tail_lines, MAX_LOG_TOTAL_BYTES // len(selected)),
-            }
-        )
+        # One 256 KiB budget covers all log text, split evenly between jobs. The
+        # summary is log text too, so when the raw tail is also returned the
+        # summary's allowance comes out of the same per-job share, keeping the
+        # pair within budget (the summary has priority; the raw tail takes what
+        # is left).
+        per_job = MAX_LOG_TOTAL_BYTES // len(selected)
+        raw_budget = max(per_job - _SUMMARY_MAX_BYTES, 0) if include_raw_log else per_job
+        tail = _tail_log(download, tail_lines, raw_budget)
+        summary = _failure_summary(tail["log"])
+        entry: dict[str, Any] = {
+            "id": job_id,
+            "name": job.get("name"),
+            "conclusion": job.get("conclusion"),
+            "html_url": job.get("html_url"),
+            "failed_steps": [
+                step.get("name")
+                for step in job.get("steps") or []
+                if step.get("conclusion") in FAILED_JOB_CONCLUSIONS
+            ],
+            "failure_summary": summary["failure_summary"],
+            "summary_lines": summary["summary_lines"],
+            "truncated": tail["truncated"] or summary["summary_truncated"],
+        }
+        if include_raw_log:
+            entry["log"] = tail["log"]
+            entry["log_lines"] = tail["log_lines"]
+        results.append(entry)
 
     failed_jobs_omitted = len(failed) - len(selected)
     return {