[guard-coverage] Guard coverage gap: 11 operations from github-mcp-server / GitHub CLI not fully covered

[github-actions]

Summary

The GitHub guard does not fully cover 11 operation(s) from the github-mcp-server and/or GitHub CLI. The main new gap is an upstream MCP write tool that is still missing from the guard inventories, and the rest are stale previously-reported CLI placeholders that no longer match the current guard model.

• MCP tools scanned: 90
• CLI write commands scanned: 41
• Guard-covered upstream MCP write tools (tools.rs): 102
• Guard-covered CLI/synthetic write tools (tools.rs): 39
• Tools with explicit DIFC rules (tool_rules.rs): 257 string-matched names plus canonical tool constant arms
• New gaps found this run: 11

---

MCP Tool Classification Gaps (tools.rs)

These MCP tools perform write or mutating operations but are missing from the upstream MCP buckets (WRITE_OPERATIONS or READ_WRITE_OPERATIONS) in guards/github-guard/rust-guard/src/tools.rs:

Tool Name	Operation Type	Suggested Classification	Notes
create_pull_request_with_copilot	write	WRITE_OPERATIONS	Upstream MCP inventory now exposes this dedicated PR-creation variant, but the guard only classifies create_pull_request. Because it does not match any fallback prefix (create_ is not currently consulted by the classifier), it is unclassified today.

Suggested fix for tools.rs

pub const WRITE_OPERATIONS: &[&str] = &[
    // ... existing entries ...
    "create_pull_request",
    "create_pull_request_with_copilot",
    "create_release",
    // ... existing entries ...
];

If create_pull_request_with_copilot is intended to share semantics with create_pull_request, it should also be included in any tests that assert inventory coverage for write tools.

---

MCP Tool DIFC Labeling Gaps (tool_rules.rs)

create_pull_request_with_copilot also has no explicit match arm in apply_tool_labels, so it currently falls through default handling instead of receiving the same repo-scoped secrecy and writer integrity treatment as create_pull_request.

Tool Name	Data Scope	Suggested Labels	Risk
create_pull_request_with_copilot	repo-scoped	secrecy: inherit S(repo), integrity: writer(repo)	Medium

Suggested fix for tool_rules.rs

Add create_pull_request_with_copilot to the same repo-scoped write arm as create_pull_request, or to the closest existing pull-request write arm if the implementation keeps PR creation separate.

---

Stale CLI Bucket / Cache Findings

These previously reported gap names no longer correspond to the current guard source buckets and should be removed from the persisted coverage state to avoid repeated false positives in future runs:

Entry	Current Evidence	Suggested Action
gh project create	Guard now models this as create_project in CLI_WRITE_OPERATIONS	Drop stale cache entry and keep canonical synthetic name only
gh secret delete	Guard now models this as delete_secret in CLI_WRITE_OPERATIONS	Drop stale cache entry
gh variable delete	Guard now models this as delete_variable in CLI_WRITE_OPERATIONS	Drop stale cache entry
gh workflow disable	Guard now models this as disable_workflow in CLI_WRITE_OPERATIONS	Drop stale cache entry
gh workflow enable	Guard now models this as enable_workflow in CLI_WRITE_OPERATIONS	Drop stale cache entry
gh secret set	Guard now models this as set_secret in CLI_WRITE_OPERATIONS	Drop stale cache entry
gh variable set	Guard now models this as set_variable in CLI_WRITE_OPERATIONS	Drop stale cache entry
gh repo sync	Guard now models this as sync_fork in CLI_WRITE_OPERATIONS	Drop stale cache entry
gh issue transfer	Guard now models this as transfer_issue in CLI_WRITE_OPERATIONS and labels it explicitly	Drop stale cache entry
gh cache delete	Guard now models this as delete_actions_cache in CLI_WRITE_OPERATIONS	Drop stale cache entry

These are not new source-code gaps, but they are still reportable coverage-state problems because the cache suppressor is carrying obsolete names instead of the canonical guard identifiers.

---

References

• github-mcp-server tools
• GitHub CLI commands
• guard tools.rs
• guard tool_rules.rs
• Run: §33350941655

Generated by GitHub Guard Coverage Checker (MCP + CLI) · copilot · gpt54 · 87.4 AIC · ⊞ 35.9K · ◷

• expires on Sep 14, 2026, 2:35 AM UTC