docs: document sink-visibility field in MCP Gateway write-sink guard policy (spec v1.15.0) by Copilot · Pull Request #44305 · github/gh-aw

Copilot · 2026-07-08T13:39:05Z

Adds formal spec coverage for the two complementary defenses against the GitLost vulnerability class (private data leaking to public repos via agentic workflows): sink-visibility (output-side DIFC filtering) and forcePublicRepos (input-side repo access restriction).

MCP Gateway spec (`mcp-gateway.md`)

§4.1.3 + §4.1.3.8 — New forcePublicRepos gateway config field: when true (default), overrides the allow-only policy to repos="public" at runtime if the gateway detects a public repository. Disabled via MCP_GATEWAY_FORCE_PUBLIC_REPOS=false or by the compiler when private-to-public-flows: allow is set.
§10.8 — Write-Sink Guard Policy: specifies sink-visibility field semantics, the DIFC enforcement model ("public" unconditionally sets resource secrecy to {}, blocking any tainted agent regardless of accept), runtime verification behavior (defense-in-depth override at startup), and the compiler-emitted runtime expression.
§10.9 — Cross-Visibility Opt-Out: documents private-to-public-flows: allow frontmatter, its incompatibility with guards_mode: strict, compiler responsibilities, and the full interaction matrix.
§11.1.12 — T-WS-001 through T-WS-008 compliance tests; Write-Sink Guard Policy row added to compliance checklist.

JSON Schemas (both `docs/public/` and `pkg/workflow/`)

New writeSinkGuardPolicyConfig definition with accept (required) and sink-visibility (optional enum: "public" | "private" | "internal").
Typed write-sink property added to guard-policies in both stdioServerConfig and httpServerConfig (the docs/public schema was missing guard-policies on stdio servers entirely).
forcePublicRepos: boolean added to gatewayConfig.

{
"mcpServers": {
"safe-outputs": {
"guard-policies": {
"write-sink": {
"accept": ["*"],
"sink-visibility": "public"
}
}
}
},
"gateway": {
"forcePublicRepos": false
}
}

The sink-visibility value is emitted as a runtime expression by the compiler (${{ toJSON(steps.determine-automatic-lockdown.outputs.visibility) }}), so workflow authors do not set it manually.

Generated by 👨‍🍳 PR Sous Chef · 9.91 AIC · ⌖ 10.6 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

✨ PR Review Safe Output Test - Run 28952113419

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"

See Network Configuration for more information.

💥 [THE END] — Illustrated by Smoke Claude · 64.8 AIC · ⌖ 31.5 AIC · ⊞ 8.4K · ◷
_{Comment /smoke-claude to run again}

Generated by 👨‍🍳 PR Sous Chef · 6.93 AIC · ⌖ 5.06 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

…spec - Add Section 4.1.3.8 documenting the new `forcePublicRepos` gateway config field - Add `forcePublicRepos` to the gateway config fields table (Section 4.1.3) - Add Section 10.8 — Write-Sink Guard Policy with full `sink-visibility` field specification, enforcement model, DIFC semantics, runtime verification, and compiler behavior - Add Section 10.9 — Cross-Visibility Opt-Out documenting `private-to-public-flows: allow` frontmatter option, its constraints, compiler responsibilities, and interaction matrix - Add compliance test category 11.1.12 with T-WS-001 through T-WS-008 - Update compliance checklist with Write-Sink Guard Policy row - Add changelog entry for spec version 1.15.0 - Update both JSON schema files (docs/public and pkg/workflow) with: - New `writeSinkGuardPolicyConfig` definition with `accept` and `sink-visibility` fields - Typed `write-sink` property in `guard-policies` for both stdioServerConfig and httpServerConfig - New `forcePublicRepos` boolean field in `gatewayConfig` - Added `guard-policies` to `stdioServerConfig` in docs/public schema (was missing) Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

…nition Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

Pull request overview

This PR updates the MCP Gateway spec and its published/internal JSON schemas to formally specify cross-visibility protections against private-data leakage to public repositories, via the forcePublicRepos gateway behavior and the write-sink / sink-visibility DIFC policy.

Changes:

Adds gateway.forcePublicRepos (default true) to the spec and both JSON schemas, documenting runtime behavior and opt-out semantics.
Defines and documents guard-policies.write-sink with accept + optional sink-visibility (public|private|internal) in the spec and both JSON schemas.
Extends the MCP Gateway spec with a new compliance-test section for write-sink behavior (T-WS-001..T-WS-008) and updates the changelog/checklist.

Show a summary per file

File	Description
pkg/workflow/schemas/mcp-gateway-config.schema.json	Adds schema definitions for `forcePublicRepos` and typed `guard-policies.write-sink` to match the updated spec.
docs/public/schemas/mcp-gateway-config.schema.json	Publishes the same schema updates for documentation consumers (including stdio server `guard-policies`).
docs/src/content/docs/reference/mcp-gateway.md	Updates spec version to 1.15.0 and adds normative sections for `forcePublicRepos`, `sink-visibility`, opt-out semantics, and compliance tests.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 3/3 changed files
Comments generated: 3
Review effort level: Low

+#### 10.8.2 `sink-visibility` Field
+
+The `write-sink` object inside `guard-policies` for a safe-outputs (or equivalent) MCP server accepts the following field:
+


+This runtime expression resolves to the actual repository visibility at workflow execution time (as determined by the automatic lockdown detection step). Workflow authors do not need to set `sink-visibility` manually — it is derived from the repository context automatically.
+
+**Configuration Example** (as rendered in the generated config):


+When `forcePublicRepos` is `true` (the default), the gateway overrides the compiled allow-only policy to `repos="public"` at startup if it detects the workflow is running in a public repository. This prevents agents from accumulating private-data secrecy tags in the first place — even when the compiled config grants broader access.
+
+**Detection mechanism**: The gateway reads `GITHUB_REPOSITORY` and calls `GET /repos/{owner}/{repo}` at startup to determine repository visibility. If the repository is public and `forcePublicRepos` is `true`, the override is applied unconditionally.
+


pelikhan · 2026-07-08T14:07:56Z

@copilot use consistent among comventions

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-08T14:14:26Z

@copilot use consistent among comventions

Fixed three inconsistencies in the spec (commit docs: fix grammar, wording, and contradiction):

Grammar (§10.8.2): "accepts the following field" → "fields" (two fields are listed).
Wording (§10.8.5): Config example label changed from "as rendered in the generated config" to "resolved runtime value — "public" shown as an example after the expression is evaluated" to clarify the snippet shows a post-evaluation value, not the raw generated expression.
Contradiction (§4.1.3.8): Removed "unconditionally" from the detection mechanism description; replaced with a forward reference to the precedence rules that list the actual gating conditions.

gh-aw-bot · 2026-07-08T14:20:32Z

@copilot please run the pr-finisher skill, address any remaining unresolved review feedback, and rerun checks once the branch is up to date.

Generated by 👨‍🍳 PR Sous Chef · 9.91 AIC · ⌖ 10.6 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Copilot · 2026-07-08T14:31:42Z

@copilot please run the pr-finisher skill, address any remaining unresolved review feedback, and rerun checks once the branch is up to date.
...

All local validation passes and the branch is up to date with main (merge commit f94d875).

Reviews: Three copilot-pull-request-reviewer[bot] threads — all is_outdated on the current HEAD; the fixes were applied in commit 804b963:

Grammar (§10.8.2): "accepts the following field" → "fields"
Wording (§10.8.5): config example relabeled as resolved runtime value
Contradiction (§4.1.3.8): "unconditionally" removed, gating conditions referenced

GraphQL API returns 403 so threads cannot be programmatically resolved — they will dismiss when a reviewer re-reviews.

Checks (local):make fmt ✅ · make lint ✅ (0 errors, warnings pre-existing) · make test-unit ✅ · make recompile ✅ · make agent-report-progress ✅

Checks (CI): Stale after agent push; needs human re-trigger (close/reopen PR or push from maintainer).

Mergeable: PR is open, not draft, branch is up to date. mergeable_state: unstable reflects the stale CI status.

Hand-off: CI must be re-triggered by a maintainer before merge.

github-actions · 2026-07-08T15:08:44Z

Comment Memory

Smoke drum beat loud
Tiny test club hit dark rock
Bot grin, sparks still jump

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · 98.6 AIC · ⌖ 4.87 AIC · ⊞ 19.1K · ◷
_{Comment /smoke-copilot to run again}
_{Add label smoke to run again}

github-actions

Smoke run done. Two cave marks left inline.

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · 98.6 AIC · ⌖ 4.87 AIC · ⊞ 19.1K
_{Comment /smoke-copilot to run again}
_{Add label smoke to run again}

github-actions · 2026-07-08T15:09:54Z

Smoke tests:

T1 ✅
T2 ✅
T3 ❌
T4 ✅
T5 ✅
T6 ✅
T7 ❌
Overall: FAIL

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot - AOAI (Entra) · 40.9 AIC · ⌖ 3.03 AIC · ⊞ 17.6K · ◷
_{Comment /smoke-copilot-aoai-entra to run again}
_{Add label smoke to run again}

gh-aw-bot · 2026-07-08T16:02:16Z

@copilot please run the pr-finisher skill, ensure the branch is up to date, and rerun checks.

Generated by 👨‍🍳 PR Sous Chef · 6.93 AIC · ⌖ 5.06 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

… net - Add sinkVisibilityExemptServers to gateway config fields table (section 4.1.3) - Add to JSON schemas in both docs/public and pkg/workflow - Document default sink-visibility="public" for non-safe-outputs (section 10.8.6) - Document safe-outputs runtime safety net (section 10.8.7) - Expand section 10.9 to support list form of private-to-public-flows - Add compiler responsibilities for list form (validation + config emission) - Update interaction matrix with list form compatibility Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

## Summary Adds the same `forcePublicRepos` defense-in-depth runtime check to the CLI proxy (`awmg proxy`) that already exists in the MCP gateway (unified mode). ## Problem The proxy receives its allow-only policy as a pre-built `--policy` JSON string from the compiler. If the compiler misconfigures the policy (e.g., `repos: "all"` when the workflow repo is public), the proxy would trust it and allow the agent to read private repos through the `gh` CLI. ## Solution Before passing the policy to the WASM guard, the proxy now: 1. Reads `GITHUB_REPOSITORY` 2. Calls `GET /repos/{owner}/{repo}` to verify visibility 3. If the repo is **public**, overrides `repos` to `"public"` in the allow-only policy This prevents agents in public-repo workflows from reading private repos, regardless of what policy the compiler passed. ## Opt-out Set `MCP_GATEWAY_FORCE_PUBLIC_REPOS=false` to disable (set by the compiler when `private-to-public-flows: allow` is declared in workflow frontmatter). ## Fail-open semantics The override is skipped when: - `MCP_GATEWAY_FORCE_PUBLIC_REPOS=false` - `GITHUB_REPOSITORY` is not set - No GitHub token is available - The API call fails In these cases, the compiled policy is used as-is. ## Companion PR - github/gh-aw#44305 — spec documentation for `forcePublicRepos` and sink-visibility

github-actions · 2026-07-09T04:05:21Z

🎉 This pull request is included in a new release.

Release: v0.82.7

Initial plan
d8dfdc7

CopilotAI assigned Copilot and lpcox Jul 8, 2026

Copilotstarted work on behalf of lpcox July 8, 2026 13:39 View session

CopilotAI linked an issue Jul 8, 2026 that may be closed by this pull request
Spec: document sink-visibility field in MCP Gateway write-sink guard policy #44290
Closed

CopilotAIand others added 3 commits July 8, 2026 13:57

fix: restore missing type and description in opentelemetryConfig defi…
a20b4e2
…nition Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

docs: clarify sink-visibility enforcement model and fallback behavior
e6f943f
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

CopilotAI changed the title ~~[WIP] Document sink-visibility field in MCP Gateway write-sink guard policy~~docs: document sink-visibility field in MCP Gateway write-sink guard policy (spec v1.15.0)Jul 8, 2026

Copilotfinished work on behalf of lpcox July 8, 2026 14:00

CopilotAI requested a review from lpcox July 8, 2026 14:00

lpcox marked this pull request as ready for review July 8, 2026 14:01

CopilotAI review requested due to automatic review settings July 8, 2026 14:01

Copilotstarted reviewing on behalf of lpcox July 8, 2026 14:01 View session

CopilotAI reviewed Jul 8, 2026
View reviewed changes

Copilotstarted work on behalf of pelikhan July 8, 2026 14:08 View session

docs: fix grammar, wording, and contradiction in mcp-gateway spec
804b963
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

CopilotAI requested a review from pelikhan July 8, 2026 14:14

Copilotfinished work on behalf of pelikhan July 8, 2026 14:14

Merge branch 'main' into copilot/document-sink-visibility-field
f94d875

github-actionsBot mentioned this pull request Jul 8, 2026
[pr-sous-chef] Run report — 5 nudged, 0 skipped #44311
Closed

Copilotstarted work on behalf of gh-aw-bot July 8, 2026 14:21 View session

Copilotfinished work on behalf of gh-aw-bot July 8, 2026 14:32

CopilotAI requested a review from gh-aw-bot July 8, 2026 14:32

lpcox added the smoke label Jul 8, 2026

github-actionsBottemporarily deployed to aoai-model July 8, 2026 14:53 Inactive

github-actionsBot mentioned this pull request Jul 8, 2026
Smoke Test: Copilot - 28952185090 #44324
Closed

github-actionsBot reviewed Jul 8, 2026
View reviewed changes

github-actionsBottemporarily deployed to aoai-model July 8, 2026 15:09 Inactive

github-actionsBot added smoke-copilot-aoai-entra and removed smoke labels Jul 8, 2026

github-actionsBottemporarily deployed to aoai-model July 8, 2026 15:10 Inactive

github-actionsBot mentioned this pull request Jul 8, 2026
[pr-sous-chef] Run report — 6 nudged, 0 skipped #44348
Closed

Copilotstarted work on behalf of gh-aw-bot July 8, 2026 16:03 View session

lpcox merged commit d4fdc96 into mainJul 8, 2026
29 checks passed

lpcox deleted the copilot/document-sink-visibility-field branch July 8, 2026 16:22

Copilot stopped work on behalf of gh-aw-bot due to an error July 8, 2026 16:22
The session was cancelled by the user.

lpcox mentioned this pull request Jul 8, 2026
feat: add force-public-repos runtime check to proxy mode github/gh-aw-mcpg#8948
Merged

This was referenced Jul 8, 2026
Smoke Test: Pi - 28961987699 #44367
Closed
Smoke Test: Claude - 28961987714 #44370
Closed
Smoke Test: Copilot - 28962041238 #44372
Closed
Smoke Test: Copilot - 28964672291 #44387
Closed
Copilot/document sink visibility field #44373
Merged
[aw] No-Op Runs #43499
Closed

github-actionsBot mentioned this pull request Jul 12, 2026
[doc-healer] DDUw improvement: stop re-attempting the rejected antigravity engine catalog sync (3rd rejection: PR #44649) #45017
Closed

CopilotAI mentioned this pull request Jul 12, 2026
Mark Antigravity as intentionally undocumented and gate engine-doc drift checks on that intent #45018
Closed

lpcox mentioned this pull request Jul 12, 2026
feat: implement private-to-public-flows: allow as a tools.github frontmatter field #45112
Closed

CopilotAI mentioned this pull request Jul 12, 2026
feat: implement private-to-public-flows: allow as a tools.github frontmatter field #45113
Merged

github-actionsBot mentioned this pull request Jul 15, 2026
[docs] Self-healing documentation fixes from issue analysis - 2026-07-15 #45578
Merged

Navigation Menu

Uh oh!

docs: document sink-visibility field in MCP Gateway write-sink guard policy (spec v1.15.0) - #44305

docs: document sink-visibility field in MCP Gateway write-sink guard policy (spec v1.15.0)#44305
lpcox merged 7 commits into
mainfrom
copilot/document-sink-visibility-field

CopilotAI commented Jul 8, 2026•
edited by github-actions Bot
Loading

Uh oh!

CopilotAI left a comment

Uh oh!

pelikhan commented Jul 8, 2026

Uh oh!

CopilotAI commented Jul 8, 2026

Uh oh!

gh-aw-bot commented Jul 8, 2026

Uh oh!

CopilotAI commented Jul 8, 2026

Uh oh!

github-actionsBot commented Jul 8, 2026

Uh oh!

github-actionsBot left a comment

Uh oh!

github-actionsBot commented Jul 8, 2026

Uh oh!

gh-aw-bot commented Jul 8, 2026

Uh oh!

Uh oh!

github-actionsBot commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

		#### 10.8.2 `sink-visibility` Field

		The `write-sink` object inside `guard-policies` for a safe-outputs (or equivalent) MCP server accepts the following field:

		This runtime expression resolves to the actual repository visibility at workflow execution time (as determined by the automatic lockdown detection step). Workflow authors do not need to set `sink-visibility` manually — it is derived from the repository context automatically.

		Configuration Example (as rendered in the generated config):

		When `forcePublicRepos` is `true` (the default), the gateway overrides the compiled allow-only policy to `repos="public"` at startup if it detects the workflow is running in a public repository. This prevents agents from accumulating private-data secrecy tags in the first place — even when the compiled config grants broader access.

		Detection mechanism: The gateway reads `GITHUB_REPOSITORY` and calls `GET /repos/{owner}/{repo}` at startup to determine repository visibility. If the repository is public and `forcePublicRepos` is `true`, the override is applied unconditionally.

Uh oh!

Conversation

CopilotAI commented Jul 8, 2026• edited by github-actions BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MCP Gateway spec (mcp-gateway.md)

JSON Schemas (both docs/public/ and pkg/workflow/)

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

pelikhan commented Jul 8, 2026

Uh oh!

CopilotAI commented Jul 8, 2026

Uh oh!

gh-aw-bot commented Jul 8, 2026

Uh oh!

CopilotAI commented Jul 8, 2026

Uh oh!

github-actionsBot commented Jul 8, 2026

Comment Memory

Uh oh!

github-actionsBot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actionsBot commented Jul 8, 2026

Uh oh!

gh-aw-bot commented Jul 8, 2026

Uh oh!

Uh oh!

github-actionsBot commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

CopilotAI commented Jul 8, 2026•
edited by github-actions Bot
Loading

MCP Gateway spec (`mcp-gateway.md`)

JSON Schemas (both `docs/public/` and `pkg/workflow/`)