[log] Add debug logging to HTTP transport client helpers by github-actions[bot] · Pull Request #9874 · github/gh-aw-mcpg

github-actions · 2026-07-22T23:49:34Z

Summary

Adds meaningful debug logging to previously unlogged functions in internal/mcp/http_transport_client.go.

Changes

headerInjectingRoundTripper.RoundTrip: logs header injection context per request (method, host, header count) — helpful when tracing custom auth flows through SDK-managed transports
resolveBaseTransport: logs which transport is resolved (existing client transport or http.DefaultTransport) during HTTP client construction

These logs are gated by the DEBUG env var under the mcp:http_transport_client namespace and write to both stderr (colorized) and the file log when enabled.

Testing

go test ./internal/mcp/ passes
go build ./internal/mcp/ succeeds

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Go Logger Enhancement · 349.5 AIC · ⊞ 7.9K · ◷

Add meaningful debug logging to previously unlogged functions in internal/mcp/http_transport_client.go: - headerInjectingRoundTripper.RoundTrip: log header injection per request (method, host, header count) for tracing custom auth flows - resolveBaseTransport: log which transport is resolved (existing or DefaultTransport) during client construction These logs are gated by the DEBUG env var (namespace 'mcp:http_transport_client') and write to both stderr (colored) and the file log when enabled. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds debug visibility to HTTP client transport helpers.

Changes:

Logs custom header injection context.
Logs base transport selection.

Show a summary per file

File	Description
`internal/mcp/http_transport_client.go`	Adds HTTP transport debug logging.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 1/1 changed files
Comments generated: 1
Review effort level: Medium

 }

 func (rt *headerInjectingRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	logHTTP.Printf("Injecting %d custom header(s) into request: method=%s, url=%s", len(rt.headers), req.Method, req.URL.Host)


github-actions · 2026-07-23T00:04:19Z

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	`unknown tool` [-32602]	BLOCKED	✅
C	CLI	reads (issues/file via `github` CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	`GH_TOKEN` not set — unauthenticated	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	`GH_TOKEN` not set — unauthenticated	BLOCKED	✅

Notes:

Part B: Gateway exposes only 21 read-only MCP tools; all write tool names return Error [-32602]: unknown tool — tools are filtered at the gateway layer.
Parts D/E: gh CLI is unauthenticated (GH_TOKEN not set), all REST and GraphQL write attempts rejected before reaching GitHub API.

Overall: PASS

References: §29967290436

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

github-actions · 2026-07-23T00:05:23Z

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	`Error [-32602]: unknown tool` (gateway rejection)	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	auth error — GH_TOKEN not set	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	auth error — GH_TOKEN not set	BLOCKED	✅

Overall: PASS

Full Report

Part B Detail

All 7 write MCP tools returned gateway-level Error [-32602]: unknown tool in ~4–6ms (fast local rejection — gateway never forwarded to backend). The gateway exposes exactly 22 read-only tools; write tools are absent from the exposed surface.

Part D & E Detail

The gh CLI has no GH_TOKEN in this runtime, so all REST and GraphQL write attempts are blocked at the auth layer. Effective boundary: mcpg (read-only MCP) + token scopes (no write token).

References: §29967290510

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

github-actions · 2026-07-23T00:06:49Z

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	`Error [-32602]: unknown tool`	BLOCKED	✅
C	CLI	reads (list_issues/get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated (no GH_TOKEN)	BLOCKED	✅

Overall: PASS

Full Report

Part B detail: The gateway enforces read-only by stripping all write tools from its MCP tool registry. Every write attempt returned Error [-32602]: unknown tool — a gateway-level MCP protocol error confirming the gateway is the enforcement point.

Parts D & E: gh CLI has no GH_TOKEN in this sandbox, so all REST write and GraphQL mutation attempts were rejected at the auth layer.

References: §29967290475

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

lpcox · 2026-07-23T04:10:45Z

@copilot address review feedback

Copilot · 2026-07-23T04:15:17Z

@copilot address review feedback

Addressed in commit 26d6f53.

I added a file-local logger.ForFile() logger in internal/mcp/http_transport_client.go and switched the client-helper debug logs to use it, so DEBUG=mcp:http_transport_client now enables these logs as expected.

github-actions Bot added automation enhancement New feature or request labels Jul 22, 2026

lpcox marked this pull request as ready for review July 22, 2026 23:59

Copilot AI review requested due to automatic review settings July 22, 2026 23:59

Copilot started reviewing on behalf of lpcox July 22, 2026 23:59 View session

Copilot AI reviewed Jul 23, 2026

View reviewed changes

Comment thread internal/mcp/http_transport_client.go Outdated

}

func (rt *headerInjectingRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {

logHTTP.Printf("Injecting %d custom header(s) into request: method=%s, url=%s", len(rt.headers), req.Method, req.URL.Host)

github-actions Bot added the readonly-stress-pass-gvisor label Jul 23, 2026

github-actions Bot added the readonly-stress-pass-default label Jul 23, 2026

Copilot started work on behalf of lpcox July 23, 2026 04:11 View session

Fix HTTP client helper logger namespace

26d6f53

Copilot finished work on behalf of lpcox July 23, 2026 04:15

Copilot AI requested a review from lpcox July 23, 2026 04:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[log] Add debug logging to HTTP transport client helpers#9874

[log] Add debug logging to HTTP transport client helpers#9874
github-actions[bot] wants to merge 2 commits into
mainfrom
log/mcp-http-transport-client-95f350697c78b644

github-actions Bot commented Jul 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Jul 23, 2026

Uh oh!

github-actions Bot commented Jul 23, 2026

Part B Detail

Part D & E Detail

Uh oh!

github-actions Bot commented Jul 23, 2026

Uh oh!

lpcox commented Jul 23, 2026

Uh oh!

Copilot AI commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

github-actions Bot commented Jul 22, 2026

Summary

Changes

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Jul 23, 2026

🔒 mcpg Read-Only Stress — gVisor

Uh oh!

github-actions Bot commented Jul 23, 2026

🔒 mcpg Read-Only Stress — default AWF

Part B Detail

Part D & E Detail

Uh oh!

github-actions Bot commented Jul 23, 2026

🔒 mcpg Read-Only Stress — docker-sbx

Uh oh!

lpcox commented Jul 23, 2026

Uh oh!

Copilot AI commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants