chore(sample-code): replace deprecated GitHub MCP server with native-fetch tools by InjunPark-sap · Pull Request #2153 · SAP/ai-sdk-js

InjunPark-sap · 2026-08-12T19:27:23Z

Context

Closes SAP/ai-sdk-js-backlog#641.

What this PR does and why it is needed

Replaces the deprecated @modelcontextprotocol/server-github MCP with four native-fetch tools (github-tools.ts), reusing the same tool names so the agent loop is untouched.
Repo scope is enforced in the URL — the model only passes a term / issue number / path, never owner, repo, or a raw query, so scope-widening tricks can't work. No new dependency.

Also folds in the post-merge follow-ups: throwOnLoadError: false + context7 libraryId allowlist (agent.ts), head+tail code-block truncation (reply.ts), and knowledge entries for prompt-registry / document-grounding / llm-batch (knowledge.ts).

No Changeset (private package), no REUSE header (wildcard), no public API change.

…fetch tools

InjunPark-sap · 2026-08-12T20:09:13Z

Deprecated @modelcontextprotocol/server-github MCP → four native-fetch tools (github-tools.ts), same tool names so the agent loop is untouched. context7 MCP retained.

Guardrail: repo scope enforced at the API call — repo hardcoded in every URL, scopedQuery() strips injected repo:/org:/user: + booleans. Model passes only a term / issue number / path, so scope-widening is impossible.

davidkna-sap · 2026-08-13T13:19:37Z

+function scopedQuery(term: string): string {
+  const stripped = (term ?? '')
+    .replace(/(?:^|\s)(?:repo|org|user):[^\s]*/gi, '')
+    .replace(/\b(?:OR|AND|NOT)\b/g, '')


Verify this, but it might also be possible to add 5 AND/NOT/OR instead, any more and searches are rejected. (e.g. AND repo:sap/ai-sdk-js).

Verified. The 5-operator cap is real (422 on the 6th). But the only actual scope-bypass is an injected repo:/org:/user: qualifier — repo:SAP/ai-sdk-js foo OR repo:golang/go bar leaks the other repo (9754 hits in my test).

Bare OR/AND/NOT never widen scope; the leading repo: binds the whole query. So I dropped the OR/AND/NOT strip and kept only the qualifier strip — boolean search works now, GitHub's 5-op limit handles the rest.

Co-authored-by: David Knaack <david.knaack@sap.com>

InjunPark-sap · 2026-08-13T13:48:07Z

context7 → hosted HTTP transport

Per David's review: switched context7 from local stdio spawn to the hosted HTTP endpoint (https://mcp.context7.com/mcp, the variant listed in mcp-registry).

Dropped @upstash/context7-mcp devDep — no local binary to spawn.
API key optional (free tier works); CONTEXT7_API_KEY header wired for higher rate limits when needed.
Side effect: removes the stdio ENOENT failure mode — a broken/missing binary can no longer kill the run.
Also resolved & allowlisted the SAP AI SDK llms.txt libraryId (/llmstxt/sap_github_io_ai-sdk_llms_txt, 1305 snippets).

Verified: tsc + lint pass; --frozen-lockfile clean; local reply.ts run loads resolve-library-id, query-docs from the hosted endpoint and cites real issues. Lockfile diff is context7-removal only (canary snapshot churn excluded).

InjunPark-sap · 2026-08-13T16:01:00Z

Widened the issue-reply trigger to all opened issues (was MEMBER/OWNER/COLLABORATOR only).

It's an open-source repo — most support questions are from external users, exactly who the old filter skipped. Abuse surface stays bounded: Slack-only, no auto issue reply, so a spam filing costs one model call + one Slack line. Per-issue concurrency guard unchanged.

… preamble, chore(sample-code): use claude-4.6-sonnet for the support bot for reliable tool use

…rences

… temperature:0, and a self-verify pass

hyperspace-pr-bot · 2026-08-14T14:02:28Z

Summary

The following content is AI-generated and provides a summary of the pull request:

Replace Deprecated GitHub MCP Server with Native-Fetch Tools

Context

Closes SAP/ai-sdk-js-backlog#641.

What this PR does and why it is needed

Replaces the deprecated @modelcontextprotocol/server-github MCP server with four native-fetch tools implemented in github-tools.ts. The new tools preserve the same tool names (github__search_issues, github__get_issue, github__search_code, github__get_file_contents) so the agent loop remains unchanged, while removing a deprecated dependency.

Key changes

sample-code/src/support-bot/github-tools.ts (new file)

Implements four GitHub tools using native fetch against the GitHub REST API
Repo scope (SAP/ai-sdk-js) is hardcoded in every URL — the model only passes keywords, an issue number, or a file path; never owner, repo, or raw query strings
Defense-in-depth: scopedQuery() strips competing repo:/org:/user: qualifiers, and results are filtered server-side to enforce scope even against unforeseen query-syntax tricks

sample-code/src/support-bot/agent.ts

Imports and wires in githubTools from the new file; removes the old MCP GitHub server config and the ALLOWED_GITHUB_TOOLS allowlist + scopeToAllowedRepo() function (now handled inside the tools themselves)
Sets throwOnLoadError: false so a context7 hiccup degrades gracefully instead of killing the run
Adds a ALLOWED_LIBRARY_IDS allowlist for context7 libraryId (SAP AI SDK docs, llms.txt variant, LangChain docs)
Extracts a dispatchToolCall() helper and a runToolTurn() helper to share SEC-3 guards and the context7 libraryId check between the draft loop and the new self-verify pass
Adds a bounded self-verify loop (MAX_VERIFY_ITER = 3) after the draft so the model re-checks factual claims against source
Refines system prompt wording: tool descriptions now state repo scope is automatic; answer rules are tightened

sample-code/src/support-bot/knowledge.ts

Adds knowledge entries for @sap-ai-sdk/prompt-registry, @sap-ai-sdk/document-grounding, and @sap-ai-sdk/llm-batch
Adds a normalization note clarifying that the Orchestration service always returns a plain string for ChatDelta.content

sample-code/src/support-bot/reply.ts

Switches code-block truncation from head-only to head + tail, preserving diagnostic signal from error stack tails

sample-code/package.json / pnpm-lock.yaml

Removes @modelcontextprotocol/server-github and @upstash/context7-mcp dev dependencies (no new dependency added)
Cleans up supports-color peer-dependency suffixes across the lockfile

🔄 Regenerate and Update Summary
✏️ Insert as PR Description (deletes this comment)
🗑️ Delete comment

PR Bot Information

Version: 1.29.26

LLM: anthropic--claude-4.6-sonnet
GithubContextProvider: chore(deps): Bump vchrisb/setup-cf from 1.0.3 to 2.0.0 #641
Correlation ID: 2e5030e0-9a29-11f1-8928-014261d490b5
Output Template: Repository PR Template
Event Trigger: issue_comment.edited
File Content Strategy: Full file content
Summary Prompt: Default Prompt

…ture:0, verify rules, and a self-verify pass

… gate

marikaner · 2026-08-17T06:00:54Z

+import { z } from 'zod';
+import type { StructuredToolInterface } from '@langchain/core/tools';
+
+// Native-fetch GitHub tools — replaces the deprecated @modelcontextprotocol/server-github.


[q] This seems odd to me. The deprecation note states that there seems to be a replacement: https://www.npmjs.com/package/@modelcontextprotocol/server-github can't we use that somehow? (=>https://github.com/github/github-mcp-server)

The successor is github/github-mcp-server which is a Go binary + hosted endpoint, not a Node drop-in.

The hosted /readonly URL fits our transport but has no single-repo scoping (only toolset/token), whereas this module hardcodes repo:SAP/ai-sdk-js so the model can't reach other repos.

Keeping that would need a fine-grained single-repo PAT — for a read-only Slack-only bot the 166-LOC module is the smaller bet.

…hub-tools

KavithaSiva

I would like to try out alternate implementation with opencode that could simplify the agent loop and uses github mcp server instead. I will open another PR, and then we can evaluate.

KavithaSiva · 2026-08-20T06:19:24Z

              "text": ("Support Issue: " + $url + "\n\n" + $answer)
            }' > /tmp/slack-payload.json

      - name: Notify Slack


[q] Which slack channel does this get posted to?

#ai-sdk-js-support

chore(sample-code): replace deprecated GitHub MCP server with native-…

9d64b3b

…fetch tools

InjunPark-sap self-assigned this Aug 12, 2026

InjunPark-sap requested review from KavithaSiva and davidkna-sap August 12, 2026 19:27

InjunPark-sap changed the title ~~chore(sample-code): replace deprecated GitHub MCP server with native-…~~ chore(sample-code): replace deprecated GitHub MCP server with native-fetch tools Aug 13, 2026

davidkna-sap reviewed Aug 13, 2026

View reviewed changes

Comment thread sample-code/src/support-bot/github-tools.ts Outdated

InjunPark-sap and others added 2 commits August 13, 2026 15:35

refactor(sample-code): switch context7 MCP to hosted HTTP transport

1d8783c

Update sample-code/src/support-bot/github-tools.ts

48e8548

Co-authored-by: David Knaack <david.knaack@sap.com>

InjunPark-sap added 4 commits August 13, 2026 15:50

verification from david's feedback

239fb99

fix(sample-code): stop support bot self-citing the answered issue

e532cc9

ci(support-bot): trigger issue-reply on all opened issues, not just team

0304fdd

fix(sample-code): force a tool-less final answer on MAX_ITER exhaustion

b937367

InjunPark-sap added 4 commits August 14, 2026 14:57

fix(sample-code): synthesize a final answer when the model stops on a…

f37cbd5

… preamble, chore(sample-code): use claude-4.6-sonnet for the support bot for reliable tool use

fix(sample-code): improve related-issue recall and drop bot self-refe…

34cbd67

…rences

Merge branch 'main' into chore/support-bot-github-tools

183c411

fix(sample-code): harden support-bot answers with normalization fact,…

6912a2d

… temperature:0, and a self-verify pass

InjunPark-sap marked this pull request as ready for review August 14, 2026 14:02

Merge branch 'main' into chore/support-bot-github-tools

e314c70

InjunPark-sap added 2 commits August 14, 2026 16:52

fix(sample-code): harden support-bot with normalization fact, tempera…

4f0e793

…ture:0, verify rules, and a self-verify pass

fix(support-bot): guard doc-error rebuttals and tighten related-issue…

9098ea2

… gate

marikaner reviewed Aug 17, 2026

View reviewed changes

InjunPark-sap added 3 commits August 17, 2026 11:49

fix from feedback

cb2fb8b

Merge remote-tracking branch 'origin/main' into chore/support-bot-git…

018602d

…hub-tools

Merge remote-tracking branch 'origin/main' into chore/support-bot-git…

99ab1de

…hub-tools

InjunPark-sap requested a review from davidkna-sap August 18, 2026 12:33

InjunPark-sap requested a review from marikaner August 18, 2026 12:33

KavithaSiva reviewed Aug 20, 2026

View reviewed changes

Navigation Menu

Uh oh!

chore(sample-code): replace deprecated GitHub MCP server with native-fetch tools - #2153

chore(sample-code): replace deprecated GitHub MCP server with native-fetch tools#2153
InjunPark-sap wants to merge 17 commits into
mainfrom
chore/support-bot-github-tools

InjunPark-sap commented Aug 12, 2026 •

edited

Loading

Uh oh!

InjunPark-sap commented Aug 12, 2026

Uh oh!

davidkna-sap Aug 13, 2026

Uh oh!

InjunPark-sap Aug 13, 2026

Uh oh!

Uh oh!

InjunPark-sap commented Aug 13, 2026

Uh oh!

InjunPark-sap commented Aug 13, 2026

Uh oh!

hyperspace-pr-bot Bot commented Aug 14, 2026 •

edited

Loading

Uh oh!

Uh oh!

marikaner Aug 17, 2026

Uh oh!

InjunPark-sap Aug 17, 2026 •

edited

Loading

Uh oh!

KavithaSiva left a comment

Uh oh!

KavithaSiva Aug 20, 2026

Uh oh!

InjunPark-sap Aug 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

InjunPark-sap commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

What this PR does and why it is needed

Uh oh!

InjunPark-sap commented Aug 12, 2026

Uh oh!

davidkna-sap Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

InjunPark-sap Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

InjunPark-sap commented Aug 13, 2026

context7 → hosted HTTP transport

Uh oh!

InjunPark-sap commented Aug 13, 2026

Uh oh!

hyperspace-pr-bot Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Replace Deprecated GitHub MCP Server with Native-Fetch Tools

Context

What this PR does and why it is needed

Key changes

Uh oh!

Uh oh!

marikaner Aug 17, 2026

Choose a reason for hiding this comment

Uh oh!

InjunPark-sap Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

KavithaSiva left a comment

Choose a reason for hiding this comment

Uh oh!

KavithaSiva Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

InjunPark-sap Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

InjunPark-sap commented Aug 12, 2026 •

edited

Loading

hyperspace-pr-bot Bot commented Aug 14, 2026 •

edited

Loading

InjunPark-sap Aug 17, 2026 •

edited

Loading