Fix safe-inputs tool secrets not passed to MCP server process #8255

Copilot · 2025-12-31T04:42:58Z

Safe-inputs tools with env: configuration (like GH_AW_GH_TOKEN in gh.md) were not receiving their secrets because the MCP server start step exported variables that didn't exist in its environment.

Changes

Add env: block to "Start Safe Inputs MCP HTTP Server" step in pkg/workflow/mcp_servers.go
- Collects tool secrets via collectSafeInputsSecrets()
- Injects them into step's environment
- Ensures MCP server process inherits correct environment
Remove redundant export statements for tool secrets in the shell script
- Variables defined in env: block are automatically available to the script
- Eliminates unnecessary exports that duplicated the environment variables

Example

Before:

- name: Start Safe Inputs MCP HTTP Server
  run: |
    export GH_AW_GH_TOKEN="${GH_AW_GH_TOKEN}"  # undefined variable
    bash start_server.sh

After:

- name: Start Safe Inputs MCP HTTP Server
  env:
    GH_AW_GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  run: |
    bash start_server.sh

All workflow lock files regenerated with the fix.

Original prompt

Review the safe inputs MCP server start code and ensure tool secrets are properly configured.

In gh.md, the GH_AW_GH_TOKEN should have been seeded with the GitHub secret.
  GH_AW_GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Add env block to "Start Safe Inputs MCP HTTP Server" step to properly pass tool-specific secrets (like GH_AW_GH_TOKEN) to the Node.js MCP server process. The issue was that the step tried to export environment variables that weren't defined in its context. Now the secrets are properly injected via the step's env block before being exported to the server process. This ensures tools like safeinputs-gh have access to secrets like GITHUB_TOKEN when they execute. Co-authored-by: pelikhan <[email protected]>

github-actions · 2025-12-31T05:26:32Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2025-12-31T05:26:33Z

✅ Firewall validation complete... Smoke Codex Firewall confirmed network sandboxing is operational. 🛡️

github-actions · 2025-12-31T05:26:33Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2025-12-31T05:26:34Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2025-12-31T05:26:34Z

📰 VERDICT: Smoke Copilot Playwright has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2025-12-31T05:26:34Z

🤖 DIAGNOSTIC COMPLETE: Smoke Copilot No Firewall STATUS: ALL_UNITS_OPERATIONAL. MISSION_SUCCESS.

github-actions · 2025-12-31T05:26:34Z

🎉 Yo ho ho! Smoke Copilot Safe Inputs found the treasure and completed successfully! ⚓💰

github-actions · 2025-12-31T05:26:37Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2025-12-31T05:28:44Z

Smoke Test Results: Copilot Engine

Last 2 Merged PRs:

Fix tests: Remove github-token from individual safe output type configurations #8254: Fix tests: Remove github-token from individual safe output type configurations
Fix repo-memory folder path to use branch name and update glob pattern matching #8252: Fix repo-memory folder path to use branch name and update glob pattern matching

Test Results:

✅ GitHub MCP Testing: Retrieved recent PRs successfully
✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-copilot-20612753926.txt
✅ Bash Tool: Verified file content via cat
✅ GitHub MCP Default Toolset: Confirmed get_me NOT available (403 error as expected)
✅ Cache Memory: Created /tmp/gh-aw/cache-memory/smoke-test-20612753926.txt
❌ MCP Gateway: No container found (expected in this environment)

Overall Status: ✅ PASS

cc: @pelikhan

📰 BREAKING: Report filed by Smoke Copilot fer issue #8255 🗺️

pelikhan · 2025-12-31T06:22:36Z

@copilot remove the export statement for secrets defined by the safe inputs env variables.

Copilot · 2025-12-31T06:28:20Z

@copilot remove the export statement for secrets defined by the safe inputs env variables.

Done in b57f55f. The redundant export statements have been removed since the tool secrets are already available via the step's env: block.

github-actions · 2025-12-31T06:35:51Z

📰 VERDICT: Smoke Copilot Playwright has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2025-12-31T06:35:51Z

🤖 DIAGNOSTIC COMPLETE: Smoke Copilot No Firewall STATUS: ALL_UNITS_OPERATIONAL. MISSION_SUCCESS.

github-actions · 2025-12-31T06:35:52Z

📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident...

github-actions · 2025-12-31T06:35:52Z

🎉 Yo ho ho! Smoke Copilot Safe Inputs found the treasure and completed successfully! ⚓💰

github-actions · 2025-12-31T06:35:52Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2025-12-31T06:35:52Z

✅ Firewall validation complete... Smoke Codex Firewall confirmed network sandboxing is operational. 🛡️

github-actions · 2025-12-31T06:35:53Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2025-12-31T06:35:53Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2025-12-31T06:37:48Z

Smoke Test Results

✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-copilot-20613677455.txt
✅ Bash Tool: File verified successfully
❌ Safe Input gh Tool: safeinputs-gh tool not available

Status: FAIL (missing required tool)

Ahoy! This treasure was crafted by 🏴‍☠️ Smoke Copilot Safe Inputs fer issue #8255 🗺️

github-actions · 2025-12-31T06:38:08Z

Smoke Test Results (Copilot No Firewall)

Last 2 Merged PRs:

Fix tests: Remove github-token from individual safe output type configurations #8254: Fix tests: Remove github-token from individual safe output type configurations
Fix repo-memory folder path to use branch name and update glob pattern matching #8252: Fix repo-memory folder path to use branch name and update glob pattern matching

Test Results:

✅ GitHub MCP: Retrieved merged PRs
✅ File Writing: Created test file successfully
✅ Bash Tool: Read file back successfully
✅ Playwright MCP: Navigated to github.com, title contains "GitHub"
⚠️ Safe Input gh Tool: NOT TESTED - Tool not available in this workflow configuration

Overall Status: PASS (4/4 core tests passed)

🤖 DIAGNOSTIC REPORT GENERATED BY Smoke Copilot No Firewall fer issue #8255 🗺️

github-actions · 2025-12-31T06:38:14Z

PR1: Fix tests: Remove github-token from individual safe output type configurations
PR2: Fix repo-memory folder path to use branch name and update glob pattern matching
OpenAI curl blocked: ✅
GitHub MCP (merged PRs) list: ✅
File write/read: ✅
Blocked domain curl: ✅
Network: SANDBOXED
Overall: PASS

🔥 Firewall tested by Smoke Codex Firewall fer issue #8255 🗺️

github-actions · 2025-12-31T06:38:20Z

Smoke Test Results (Run 20613677472)

✅ Cache Memory Test: Successfully wrote and verified cache file
❌ Playwright MCP Test: Playwright tools not available
❌ Safe Input gh Tool Test: safeinputs-gh tool not available

Overall Status: ❌ FAIL

Note: Missing required tools for complete validation

📰 BREAKING: Report filed by Smoke Copilot Playwright fer issue #8255 🗺️

github-actions · 2025-12-31T06:38:38Z

PRs reviewed (latest merged): 8254 Fix tests: Remove github-token from individual safe output type configurations; 8252 Fix repo-memory folder path to use branch name and update glob pattern matching.
GitHub MCP PR fetch ✅
File write /tmp/gh-aw/agent/... + cat ✅
Playwright github.com title check ✅
Cache memory write + cat ✅
safeinputs-gh gh issues list --limit 3 ❌ (command not found)
Overall: FAIL due to safeinputs-gh missing.

🔮 The oracle has spoken through Smoke Codex fer issue #8255 🗺️

github-actions · 2025-12-31T06:38:51Z

Smoke Test Results

Last 2 merged PRs:

Fix tests: Remove github-token from individual safe output type configurations #8254: Fix tests: Remove github-token from individual safe output type configurations
Fix repo-memory folder path to use branch name and update glob pattern matching #8252: Fix repo-memory folder path to use branch name and update glob pattern matching

Test Results:

✅ GitHub MCP: Retrieved recent PRs
✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-claude-20613677459.txt
✅ Bash Tool: Verified file creation
✅ Playwright MCP: Navigated to github.com, title contains "GitHub"
✅ Cache Memory: Created /tmp/gh-aw/cache-memory/smoke-test-20613677459.txt
❌ Safe Input gh Tool: Tool not available

Overall: PASS (5/6 tests passed)

💥 [THE END] — Illustrated by Smoke Claude fer issue #8255 🗺️

Copilot AI self-assigned this Dec 31, 2025

Initial plan

5625b9c

Copilot AI assigned pelikhan Dec 31, 2025

Copilot started work on behalf of pelikhan December 31, 2025 04:43 View session

Copilot AI changed the title ~~[WIP] Review safe inputs MCP server start code~~ Fix safe-inputs tool secrets not passed to MCP server process Dec 31, 2025

Copilot AI requested a review from pelikhan December 31, 2025 05:01

Copilot finished work on behalf of pelikhan December 31, 2025 05:01

pelikhan added the smoke label Dec 31, 2025

This comment has been minimized.

Sign in to view

github-actions bot added the smoke-copilot label Dec 31, 2025

This comment has been minimized.

Sign in to view

github-actions bot added the smoke-copilot-no-firewall label Dec 31, 2025

This comment has been minimized.

Sign in to view

github-actions bot added the smoke-codex-firewall label Dec 31, 2025

Add changeset [skip-ci]

097a197

This comment has been minimized.

Sign in to view

Copilot started work on behalf of pelikhan December 31, 2025 06:23 View session

Copilot finished work on behalf of pelikhan December 31, 2025 06:29

pelikhan added smoke and removed smoke smoke-copilot-no-firewall smoke-copilot smoke-codex-firewall labels Dec 31, 2025

github-actions bot added the smoke-copilot-no-firewall label Dec 31, 2025

github-actions bot added the smoke-codex-firewall label Dec 31, 2025

Add changeset: patch fix safe-inputs secrets [skip-ci]

f78f064

github-actions bot added the smoke-claude label Dec 31, 2025

pelikhan approved these changes Dec 31, 2025

View reviewed changes

pelikhan marked this pull request as ready for review December 31, 2025 06:49

pelikhan merged commit 4c1bf3a into main Dec 31, 2025
17 of 18 checks passed

pelikhan deleted the copilot/review-safe-inputs-code branch December 31, 2025 06:49

github-actions bot mentioned this pull request Dec 31, 2025

[team-status] Daily Team Status: December 31, 2025 - Productive Code Quality Day! 🌟 #8273

Open

Fix safe-inputs tool secrets not passed to MCP server process #8255

Fix safe-inputs tool secrets not passed to MCP server process #8255

Uh oh!

Conversation

Copilot AI commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Example

Uh oh!

github-actions bot commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 31, 2025 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

github-actions bot commented Dec 31, 2025

Smoke Test Results: Copilot Engine

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

pelikhan commented Dec 31, 2025

Uh oh!

Copilot AI commented Dec 31, 2025

Uh oh!

github-actions bot commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 31, 2025 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 31, 2025

Smoke Test Results

Uh oh!

github-actions bot commented Dec 31, 2025

Smoke Test Results (Copilot No Firewall)

Uh oh!

github-actions bot commented Dec 31, 2025

Uh oh!

github-actions bot commented Dec 31, 2025

Smoke Test Results (Run 20613677472)

Copilot AI commented Dec 31, 2025 •

edited

Loading

github-actions bot commented Dec 31, 2025 •

edited

Loading

github-actions bot commented Dec 31, 2025 •

edited

Loading

github-actions bot commented Dec 31, 2025 •

edited

Loading

github-actions bot commented Dec 31, 2025 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Dec 31, 2025 •

edited

Loading

github-actions bot commented Dec 31, 2025 •

edited

Loading

github-actions bot commented Dec 31, 2025 •

edited

Loading

github-actions bot commented Dec 31, 2025 •

edited

Loading

github-actions bot commented Dec 31, 2025 •

edited

Loading

github-actions bot commented Dec 31, 2025 •

edited

Loading

github-actions bot commented Dec 31, 2025 •

edited

Loading

github-actions bot commented Dec 31, 2025 •

edited

Loading

github-actions bot commented Dec 31, 2025 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Dec 31, 2025 •

edited

Loading

github-actions bot commented Dec 31, 2025 •

edited

Loading

github-actions bot commented Dec 31, 2025 •

edited

Loading