[larsvikb]

What

mcp-github goes from v1.9.0 to v1.12.2. No configuration changes; the one comment
that changes is the lockdown one, because what it described was not happening.

Lockdown was never on

On v1.9.0, http mode computed lockdown as d.lockdownMode && ghcontext.IsLockdownMode(ctx) — the server's GITHUB_LOCKDOWN_MODE AND a
per-request X-MCP-Lockdown header. Nothing in dockade sends that header, so the
"1" in mcp-servers.yml did nothing. v1.10.0 (github/github-mcp-server#3112) made
it ||, so the server setting is sufficient on its own.

That makes this bump a behaviour change and not only a version: public-repo content
from authors without push access is now filtered from results. It is the second of
this server's flags found inert — read-only was the first, through v0.31.0 — and the
comment now says so, next to the reminder that neither flag is the boundary.

What else moved, and why none of it is a regression here

Read from the release notes, the upstream source and the tool snapshots at both tags;
the evidence is in NOTES.md.

• New write tools. A tool with no rule is ask, so every one arrives held. In the
  catalogue's default toolsets that is update_issue_comment; with
  GITHUB_MCP_TOOLSETS=all also create_repository_ruleset and
  custom_properties_write, from a new Governance toolset.
• delete_repository is in the snapshots but the running server does not list it.
  It could not succeed through dockade anyway: it confirms through a multi-round-trip
  elicitation read from req.Params.InputResponses, and the gateway sends name and
  arguments only.
• No dispatcher in the default toolsets grew. Under all, projects_write gains
  three project-view methods including delete_project_view — a rule written for it
  on v1.9.0 now decides those too — and repository_ruleset_read is a new
  five-method dispatcher, all reads.
• Per-call OAuth scope challenges (v1.11.0) act only on gho_ tokens; the classic-PAT
  filter still skips itself when the scope lookup fails, so dummy-token enumeration
  is unchanged.
• The server's new 5 MiB request cap is above the gateway's.
• arguments: null is now rejected; the gateway already sends {}.
• Symlink writes via create_or_update_file now need allow_symlink_write: true.

Worth building on later: merge_pull_request gains expectedHeadSha, which makes
GitHub refuse a merge whose head moved after it was reviewed.

Tests

• make lint, make consistency, make test pass.
• On the host, with the new image running: make mcp-tools SERVER=github lists 25
  tools, all read-only, with the dispatchers' methods unchanged, on the catalogue
  defaults; and 90 tools, 34 not read-only, with GITHUB_MCP_TOOLSETS=all and
  GITHUB_MCP_READ_ONLY=0 — matching the snapshot diff except that
  delete_repository is withheld. make check-boundary passes (26 checks).
• A real get_file_contents through the gateway returned the repository root —
  gateway, server, egress proxy and injected token end to end.
• This PR itself was opened through the gateway against the v1.12.2 server, so
  create_pull_request is exercised end to end as well.

Not exercised: lockdown filtering itself.

How to test

make mcp-up SERVER=github && make mcp-tools SERVER=github
make check-boundary

Note: .env is gitignored, so a worktree without a copy starts the server on the
catalogue defaults (read-only, four toolsets) rather than your local settings.

Generated with Claude Code