fix: wrap github MCP config with mcpServers in issue-triage workflow

Update the MCP configuration structure to properly wrap the github
server configuration within an mcpServers object, matching the
expected format for MCP config files.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

action.yml

@@ -105,7 +105,7 @@ runs:
     - name: Run Claude Code
       id: claude-code
       if: steps.prepare.outputs.contains_trigger == 'true'
-      uses: anthropics/claude-code-base-action@9e4e150978667888ba2108a2ee63a79bf9cfbe06 # v0.0.10
+      uses: anthropics/claude-code-base-action@1370ac97fbba9bddec20ea2924b5726bf10d8b94 # v0.0.9
       with:
         prompt_file: /tmp/claude-prompts/claude-prompt.txt
         allowed_tools: ${{ env.ALLOWED_TOOLS }}

src/create-prompt/index.ts

@@ -35,35 +35,38 @@ const BASE_ALLOWED_TOOLS = [
 ];
 const DISALLOWED_TOOLS = ["WebSearch", "WebFetch"];
 
-export function buildAllowedToolsString(customAllowedTools?: string[]): string {
+export function buildAllowedToolsString(customAllowedTools?: string): string {
   let baseTools = [...BASE_ALLOWED_TOOLS];
 
   let allAllowedTools = baseTools.join(",");
-  if (customAllowedTools && customAllowedTools.length > 0) {
-    allAllowedTools = `${allAllowedTools},${customAllowedTools.join(",")}`;
+  if (customAllowedTools) {
+    allAllowedTools = `${allAllowedTools},${customAllowedTools}`;
   }
   return allAllowedTools;
 }
 
 export function buildDisallowedToolsString(
-  customDisallowedTools?: string[],
-  allowedTools?: string[],
+  customDisallowedTools?: string,
+  allowedTools?: string,
 ): string {
   let disallowedTools = [...DISALLOWED_TOOLS];
 
   // If user has explicitly allowed some hardcoded disallowed tools, remove them from disallowed list
-  if (allowedTools && allowedTools.length > 0) {
+  if (allowedTools) {
+    const allowedToolsArray = allowedTools
+      .split(",")
+      .map((tool) => tool.trim());
     disallowedTools = disallowedTools.filter(
-      (tool) => !allowedTools.includes(tool),
+      (tool) => !allowedToolsArray.includes(tool),
     );
   }
 
   let allDisallowedTools = disallowedTools.join(",");
-  if (customDisallowedTools && customDisallowedTools.length > 0) {
+  if (customDisallowedTools) {
     if (allDisallowedTools) {
-      allDisallowedTools = `${allDisallowedTools},${customDisallowedTools.join(",")}`;
+      allDisallowedTools = `${allDisallowedTools},${customDisallowedTools}`;
     } else {
-      allDisallowedTools = customDisallowedTools.join(",");
+      allDisallowedTools = customDisallowedTools;
     }
   }
   return allDisallowedTools;
@@ -117,10 +120,8 @@ export function prepareContext(
     triggerPhrase,
     ...(triggerUsername && { triggerUsername }),
     ...(customInstructions && { customInstructions }),
-    ...(allowedTools.length > 0 && { allowedTools: allowedTools.join(",") }),
-    ...(disallowedTools.length > 0 && {
-      disallowedTools: disallowedTools.join(","),
-    }),
+    ...(allowedTools && { allowedTools }),
+    ...(disallowedTools && { disallowedTools }),
     ...(directPrompt && { directPrompt }),
     ...(claudeBranch && { claudeBranch }),
   };
@@ -635,11 +636,11 @@ export async function createPrompt(
 
     // Set allowed tools
     const allAllowedTools = buildAllowedToolsString(
-      context.inputs.allowedTools,
+      preparedContext.allowedTools,
     );
     const allDisallowedTools = buildDisallowedToolsString(
-      context.inputs.disallowedTools,
-      context.inputs.allowedTools,
+      preparedContext.disallowedTools,
+      preparedContext.allowedTools,
     );
 
     core.exportVariable("ALLOWED_TOOLS", allAllowedTools);

src/entrypoints/prepare.ts

@@ -92,7 +92,6 @@ async function run() {
       branch: branchInfo.currentBranch,
       additionalMcpConfig,
       claudeCommentId: commentId.toString(),
-      allowedTools: context.inputs.allowedTools,
     });
     core.setOutput("mcp_config", mcpConfig);
   } catch (error) {

src/github/context.ts

@@ -28,8 +28,8 @@ export type ParsedGitHubContext = {
   inputs: {
     triggerPhrase: string;
     assigneeTrigger: string;
-    allowedTools: string[];
-    disallowedTools: string[];
+    allowedTools: string;
+    disallowedTools: string;
     customInstructions: string;
     directPrompt: string;
     baseBranch?: string;
@@ -52,14 +52,8 @@ export function parseGitHubContext(): ParsedGitHubContext {
     inputs: {
       triggerPhrase: process.env.TRIGGER_PHRASE ?? "@claude",
       assigneeTrigger: process.env.ASSIGNEE_TRIGGER ?? "",
-      allowedTools: (process.env.ALLOWED_TOOLS ?? "")
-        .split(",")
-        .map((tool) => tool.trim())
-        .filter((tool) => tool.length > 0),
-      disallowedTools: (process.env.DISALLOWED_TOOLS ?? "")
-        .split(",")
-        .map((tool) => tool.trim())
-        .filter((tool) => tool.length > 0),
+      allowedTools: process.env.ALLOWED_TOOLS ?? "",
+      disallowedTools: process.env.DISALLOWED_TOOLS ?? "",
       customInstructions: process.env.CUSTOM_INSTRUCTIONS ?? "",
       directPrompt: process.env.DIRECT_PROMPT ?? "",
       baseBranch: process.env.BASE_BRANCH,

src/github/data/fetcher.ts

@@ -1,17 +1,17 @@
 import { execSync } from "child_process";
-import type { Octokits } from "../api/client";
-import { ISSUE_QUERY, PR_QUERY } from "../api/queries/github";
 import type {
+  GitHubPullRequest,
+  GitHubIssue,
   GitHubComment,
   GitHubFile,
-  GitHubIssue,
-  GitHubPullRequest,
   GitHubReview,
-  IssueQueryResponse,
   PullRequestQueryResponse,
+  IssueQueryResponse,
 } from "../types";
-import type { CommentWithImages } from "../utils/image-downloader";
+import { PR_QUERY, ISSUE_QUERY } from "../api/queries/github";
+import type { Octokits } from "../api/client";
 import { downloadCommentImages } from "../utils/image-downloader";
+import type { CommentWithImages } from "../utils/image-downloader";
 
 type FetchDataParams = {
   octokits: Octokits;
@@ -101,14 +101,6 @@ export async function fetchGitHubData({
   let changedFilesWithSHA: GitHubFileWithSHA[] = [];
   if (isPR && changedFiles.length > 0) {
     changedFilesWithSHA = changedFiles.map((file) => {
-      // Don't compute SHA for deleted files
-      if (file.changeType === "DELETED") {
-        return {
-          ...file,
-          sha: "deleted",
-        };
-      }
-
       try {
         // Use git hash-object to compute the SHA for the current file content
         const sha = execSync(`git hash-object "${file.path}"`, {

src/mcp/install-mcp-server.ts

@@ -7,7 +7,6 @@ type PrepareConfigParams = {
   branch: string;
   additionalMcpConfig?: string;
   claudeCommentId?: string;
-  allowedTools: string[];
 };
 
 export async function prepareMcpConfig(
@@ -20,17 +19,24 @@ export async function prepareMcpConfig(
     branch,
     additionalMcpConfig,
     claudeCommentId,
-    allowedTools,
   } = params;
   try {
-    const allowedToolsList = allowedTools || [];
-
-    const hasGitHubMcpTools = allowedToolsList.some((tool) =>
-      tool.startsWith("mcp__github__"),
-    );
-
-    const baseMcpConfig: { mcpServers: Record<string, unknown> } = {
+    const baseMcpConfig = {
       mcpServers: {
+        github: {
+          command: "docker",
+          args: [
+            "run",
+            "-i",
+            "--rm",
+            "-e",
+            "GITHUB_PERSONAL_ACCESS_TOKEN",
+            "ghcr.io/anthropics/github-mcp-server:sha-7382253",
+          ],
+          env: {
+            GITHUB_PERSONAL_ACCESS_TOKEN: githubToken,
+          },
+        },
         github_file_ops: {
           command: "bun",
           args: [
@@ -51,23 +57,6 @@ export async function prepareMcpConfig(
       },
     };
 
-    if (hasGitHubMcpTools) {
-      baseMcpConfig.mcpServers.github = {
-        command: "docker",
-        args: [
-          "run",
-          "-i",
-          "--rm",
-          "-e",
-          "GITHUB_PERSONAL_ACCESS_TOKEN",
-          "ghcr.io/github/github-mcp-server:sha-e9f748f", // https://github.com/github/github-mcp-server/releases/tag/v0.4.0
-        ],
-        env: {
-          GITHUB_PERSONAL_ACCESS_TOKEN: githubToken,
-        },
-      };
-    }
-
     // Merge with additional MCP config if provided
     if (additionalMcpConfig && additionalMcpConfig.trim()) {
       try {

test/create-prompt.test.ts

@@ -652,7 +652,7 @@ describe("buildAllowedToolsString", () => {
   });
 
   test("should append custom tools when provided", () => {
-    const customTools = ["Tool1", "Tool2", "Tool3"];
+    const customTools = "Tool1,Tool2,Tool3";
     const result = buildAllowedToolsString(customTools);
 
     // Base tools should be present
@@ -683,7 +683,7 @@ describe("buildDisallowedToolsString", () => {
   });
 
   test("should append custom disallowed tools when provided", () => {
-    const customDisallowedTools = ["BadTool1", "BadTool2"];
+    const customDisallowedTools = "BadTool1,BadTool2";
     const result = buildDisallowedToolsString(customDisallowedTools);
 
     // Base disallowed tools should be present
@@ -701,8 +701,8 @@ describe("buildDisallowedToolsString", () => {
   });
 
   test("should remove hardcoded disallowed tools if they are in allowed tools", () => {
-    const customDisallowedTools = ["BadTool1", "BadTool2"];
-    const allowedTools = ["WebSearch", "SomeOtherTool"];
+    const customDisallowedTools = "BadTool1,BadTool2";
+    const allowedTools = "WebSearch,SomeOtherTool";
     const result = buildDisallowedToolsString(
       customDisallowedTools,
       allowedTools,
@@ -720,7 +720,7 @@ describe("buildDisallowedToolsString", () => {
   });
 
   test("should remove all hardcoded disallowed tools if they are all in allowed tools", () => {
-    const allowedTools = ["WebSearch", "WebFetch", "SomeOtherTool"];
+    const allowedTools = "WebSearch,WebFetch,SomeOtherTool";
     const result = buildDisallowedToolsString(undefined, allowedTools);
 
     // Both hardcoded disallowed tools should be removed
@@ -732,8 +732,8 @@ describe("buildDisallowedToolsString", () => {
   });
 
   test("should handle custom disallowed tools when all hardcoded tools are overridden", () => {
-    const customDisallowedTools = ["BadTool1", "BadTool2"];
-    const allowedTools = ["WebSearch", "WebFetch"];
+    const customDisallowedTools = "BadTool1,BadTool2";
+    const allowedTools = "WebSearch,WebFetch";
     const result = buildDisallowedToolsString(
       customDisallowedTools,
       allowedTools,

test/install-mcp-server.test.ts

@@ -24,19 +24,21 @@ describe("prepareMcpConfig", () => {
     processExitSpy.mockRestore();
   });
 
-  test("should return base config when no additional config is provided and no allowed_tools", async () => {
+  test("should return base config when no additional config is provided", async () => {
     const result = await prepareMcpConfig({
       githubToken: "test-token",
       owner: "test-owner",
       repo: "test-repo",
       branch: "test-branch",
-      allowedTools: [],
     });
 
     const parsed = JSON.parse(result);
     expect(parsed.mcpServers).toBeDefined();
-    expect(parsed.mcpServers.github).not.toBeDefined();
+    expect(parsed.mcpServers.github).toBeDefined();
     expect(parsed.mcpServers.github_file_ops).toBeDefined();
+    expect(parsed.mcpServers.github.env.GITHUB_PERSONAL_ACCESS_TOKEN).toBe(
+      "test-token",
+    );
     expect(parsed.mcpServers.github_file_ops.env.GITHUB_TOKEN).toBe(
       "test-token",
     );
@@ -47,60 +49,6 @@ describe("prepareMcpConfig", () => {
     );
   });
 
-  test("should include github MCP server when mcp__github__ tools are allowed", async () => {
-    const result = await prepareMcpConfig({
-      githubToken: "test-token",
-      owner: "test-owner",
-      repo: "test-repo",
-      branch: "test-branch",
-      allowedTools: [
-        "mcp__github__create_issue",
-        "mcp__github_file_ops__commit_files",
-      ],
-    });
-
-    const parsed = JSON.parse(result);
-    expect(parsed.mcpServers).toBeDefined();
-    expect(parsed.mcpServers.github).toBeDefined();
-    expect(parsed.mcpServers.github_file_ops).toBeDefined();
-    expect(parsed.mcpServers.github.env.GITHUB_PERSONAL_ACCESS_TOKEN).toBe(
-      "test-token",
-    );
-  });
-
-  test("should not include github MCP server when only file_ops tools are allowed", async () => {
-    const result = await prepareMcpConfig({
-      githubToken: "test-token",
-      owner: "test-owner",
-      repo: "test-repo",
-      branch: "test-branch",
-      allowedTools: [
-        "mcp__github_file_ops__commit_files",
-        "mcp__github_file_ops__update_claude_comment",
-      ],
-    });
-
-    const parsed = JSON.parse(result);
-    expect(parsed.mcpServers).toBeDefined();
-    expect(parsed.mcpServers.github).not.toBeDefined();
-    expect(parsed.mcpServers.github_file_ops).toBeDefined();
-  });
-
-  test("should include file_ops server even when no GitHub tools are allowed", async () => {
-    const result = await prepareMcpConfig({
-      githubToken: "test-token",
-      owner: "test-owner",
-      repo: "test-repo",
-      branch: "test-branch",
-      allowedTools: ["Edit", "Read", "Write"],
-    });
-
-    const parsed = JSON.parse(result);
-    expect(parsed.mcpServers).toBeDefined();
-    expect(parsed.mcpServers.github).not.toBeDefined();
-    expect(parsed.mcpServers.github_file_ops).toBeDefined();
-  });
-
   test("should return base config when additional config is empty string", async () => {
     const result = await prepareMcpConfig({
       githubToken: "test-token",
@@ -108,12 +56,11 @@ describe("prepareMcpConfig", () => {
       repo: "test-repo",
       branch: "test-branch",
       additionalMcpConfig: "",
-      allowedTools: [],
     });
 
     const parsed = JSON.parse(result);
     expect(parsed.mcpServers).toBeDefined();
-    expect(parsed.mcpServers.github).not.toBeDefined();
+    expect(parsed.mcpServers.github).toBeDefined();
     expect(parsed.mcpServers.github_file_ops).toBeDefined();
     expect(consoleWarningSpy).not.toHaveBeenCalled();
   });
@@ -125,12 +72,11 @@ describe("prepareMcpConfig", () => {
       repo: "test-repo",
       branch: "test-branch",
       additionalMcpConfig: "   \n\t  ",
-      allowedTools: [],
     });
 
     const parsed = JSON.parse(result);
     expect(parsed.mcpServers).toBeDefined();
-    expect(parsed.mcpServers.github).not.toBeDefined();
+    expect(parsed.mcpServers.github).toBeDefined();
     expect(parsed.mcpServers.github_file_ops).toBeDefined();
     expect(consoleWarningSpy).not.toHaveBeenCalled();
   });
@@ -154,10 +100,6 @@ describe("prepareMcpConfig", () => {
       repo: "test-repo",
       branch: "test-branch",
       additionalMcpConfig: additionalConfig,
-      allowedTools: [
-        "mcp__github__create_issue",
-        "mcp__github_file_ops__commit_files",
-      ],
     });
 
     const parsed = JSON.parse(result);
@@ -191,10 +133,6 @@ describe("prepareMcpConfig", () => {
       repo: "test-repo",
       branch: "test-branch",
       additionalMcpConfig: additionalConfig,
-      allowedTools: [
-        "mcp__github__create_issue",
-        "mcp__github_file_ops__commit_files",
-      ],
     });
 
     const parsed = JSON.parse(result);
@@ -231,13 +169,12 @@ describe("prepareMcpConfig", () => {
       repo: "test-repo",
       branch: "test-branch",
       additionalMcpConfig: additionalConfig,
-      allowedTools: [],
     });
 
     const parsed = JSON.parse(result);
     expect(parsed.customProperty).toBe("custom-value");
     expect(parsed.anotherProperty).toEqual({ nested: "value" });
-    expect(parsed.mcpServers.github).not.toBeDefined();
+    expect(parsed.mcpServers.github).toBeDefined();
     expect(parsed.mcpServers.custom_server).toBeDefined();
   });
 
@@ -250,14 +187,13 @@ describe("prepareMcpConfig", () => {
       repo: "test-repo",
       branch: "test-branch",
       additionalMcpConfig: invalidJson,
-      allowedTools: [],
     });
 
     const parsed = JSON.parse(result);
     expect(consoleWarningSpy).toHaveBeenCalledWith(
       expect.stringContaining("Failed to parse additional MCP config:"),
     );
-    expect(parsed.mcpServers.github).not.toBeDefined();
+    expect(parsed.mcpServers.github).toBeDefined();
     expect(parsed.mcpServers.github_file_ops).toBeDefined();
   });
 
@@ -270,7 +206,6 @@ describe("prepareMcpConfig", () => {
       repo: "test-repo",
       branch: "test-branch",
       additionalMcpConfig: nonObjectJson,
-      allowedTools: [],
     });
 
     const parsed = JSON.parse(result);
@@ -280,7 +215,7 @@ describe("prepareMcpConfig", () => {
     expect(consoleWarningSpy).toHaveBeenCalledWith(
       expect.stringContaining("MCP config must be a valid JSON object"),
     );
-    expect(parsed.mcpServers.github).not.toBeDefined();
+    expect(parsed.mcpServers.github).toBeDefined();
     expect(parsed.mcpServers.github_file_ops).toBeDefined();
   });
 
@@ -293,7 +228,6 @@ describe("prepareMcpConfig", () => {
       repo: "test-repo",
       branch: "test-branch",
       additionalMcpConfig: nullJson,
-      allowedTools: [],
     });
 
     const parsed = JSON.parse(result);
@@ -303,7 +237,7 @@ describe("prepareMcpConfig", () => {
     expect(consoleWarningSpy).toHaveBeenCalledWith(
       expect.stringContaining("MCP config must be a valid JSON object"),
     );
-    expect(parsed.mcpServers.github).not.toBeDefined();
+    expect(parsed.mcpServers.github).toBeDefined();
     expect(parsed.mcpServers.github_file_ops).toBeDefined();
   });
 
@@ -316,7 +250,6 @@ describe("prepareMcpConfig", () => {
       repo: "test-repo",
       branch: "test-branch",
       additionalMcpConfig: arrayJson,
-      allowedTools: [],
     });
 
     const parsed = JSON.parse(result);
@@ -325,7 +258,7 @@ describe("prepareMcpConfig", () => {
     expect(consoleInfoSpy).toHaveBeenCalledWith(
       "Merging additional MCP server configuration with built-in servers",
     );
-    expect(parsed.mcpServers.github).not.toBeDefined();
+    expect(parsed.mcpServers.github).toBeDefined();
     expect(parsed.mcpServers.github_file_ops).toBeDefined();
     // The array will be spread into the config (0: 1, 1: 2, 2: 3)
     expect(parsed[0]).toBe(1);
@@ -362,13 +295,12 @@ describe("prepareMcpConfig", () => {
       repo: "test-repo",
       branch: "test-branch",
       additionalMcpConfig: additionalConfig,
-      allowedTools: [],
     });
 
     const parsed = JSON.parse(result);
     expect(parsed.mcpServers.server1).toBeDefined();
     expect(parsed.mcpServers.server2).toBeDefined();
-    expect(parsed.mcpServers.github).not.toBeDefined();
+    expect(parsed.mcpServers.github).toBeDefined();
     expect(parsed.mcpServers.github_file_ops.command).toBe("overridden");
     expect(parsed.mcpServers.github_file_ops.env.CUSTOM).toBe("value");
     expect(parsed.otherConfig.nested.deeply).toBe("value");
@@ -383,7 +315,6 @@ describe("prepareMcpConfig", () => {
       owner: "test-owner",
       repo: "test-repo",
       branch: "test-branch",
-      allowedTools: [],
     });
 
     const parsed = JSON.parse(result);
@@ -403,7 +334,6 @@ describe("prepareMcpConfig", () => {
       owner: "test-owner",
       repo: "test-repo",
       branch: "test-branch",
-      allowedTools: [],
     });
 
     const parsed = JSON.parse(result);

test/mockContext.ts

@@ -11,8 +11,8 @@ const defaultInputs = {
   triggerPhrase: "/claude",
   assigneeTrigger: "",
   anthropicModel: "claude-3-7-sonnet-20250219",
-  allowedTools: [] as string[],
-  disallowedTools: [] as string[],
+  allowedTools: "",
+  disallowedTools: "",
   customInstructions: "",
   directPrompt: "",
   useBedrock: false,

test/permissions.test.ts

@@ -62,8 +62,8 @@ describe("checkWritePermissions", () => {
     inputs: {
       triggerPhrase: "@claude",
       assigneeTrigger: "",
-      allowedTools: [],
-      disallowedTools: [],
+      allowedTools: "",
+      disallowedTools: "",
       customInstructions: "",
       directPrompt: "",
     },

test/prepare-context.test.ts

@@ -242,7 +242,7 @@ describe("parseEnvVarsWithContext", () => {
         ...mockPullRequestCommentContext,
         inputs: {
           ...mockPullRequestCommentContext.inputs,
-          allowedTools: ["Tool1", "Tool2"],
+          allowedTools: "Tool1,Tool2",
         },
       });
       const result = prepareContext(contextWithAllowedTools, "12345");

test/trigger-validation.test.ts

@@ -30,8 +30,8 @@ describe("checkContainsTrigger", () => {
           triggerPhrase: "/claude",
           assigneeTrigger: "",
           directPrompt: "Fix the bug in the login form",
-          allowedTools: [],
-          disallowedTools: [],
+          allowedTools: "",
+          disallowedTools: "",
           customInstructions: "",
         },
       });
@@ -56,8 +56,8 @@ describe("checkContainsTrigger", () => {
           triggerPhrase: "/claude",
           assigneeTrigger: "",
           directPrompt: "",
-          allowedTools: [],
-          disallowedTools: [],
+          allowedTools: "",
+          disallowedTools: "",
           customInstructions: "",
         },
       });
@@ -228,8 +228,8 @@ describe("checkContainsTrigger", () => {
           triggerPhrase: "@claude",
           assigneeTrigger: "",
           directPrompt: "",
-          allowedTools: [],
-          disallowedTools: [],
+          allowedTools: "",
+          disallowedTools: "",
           customInstructions: "",
         },
       });
@@ -255,8 +255,8 @@ describe("checkContainsTrigger", () => {
           triggerPhrase: "@claude",
           assigneeTrigger: "",
           directPrompt: "",
-          allowedTools: [],
-          disallowedTools: [],
+          allowedTools: "",
+          disallowedTools: "",
           customInstructions: "",
         },
       });
@@ -282,8 +282,8 @@ describe("checkContainsTrigger", () => {
           triggerPhrase: "@claude",
           assigneeTrigger: "",
           directPrompt: "",
-          allowedTools: [],
-          disallowedTools: [],
+          allowedTools: "",
+          disallowedTools: "",
           customInstructions: "",
         },
       });