Summary

The GitHub guard does not fully cover 1 operation from the github-mcp-server. The set_issue_fields tool was added to the upstream MCP server since the last coverage check and is missing from both the write-operation classification in tools.rs and the DIFC labeling rules in tool_rules.rs.

• MCP tools scanned: 102 (↑ from 82 on 2026-04-13, +20 new tools)
• CLI write commands scanned: 45 (unchanged)
• Guard-covered write tools (tools.rs): 57 WRITE_OPERATIONS + 30 READ_WRITE_OPERATIONS = 87 entries
• Tools with explicit DIFC rules (tool_rules.rs): ~48 match groups
• New gaps found this run: 1

MCP Tool Classification Gaps (tools.rs)

set_issue_fields performs a write/mutating operation but is missing from WRITE_OPERATIONS or READ_WRITE_OPERATIONS in guards/github-guard/rust-guard/src/tools.rs:

Suggested fix for tools.rs

// Add to READ_WRITE_OPERATIONS alongside the other granular issue update tools:
pub const READ_WRITE_OPERATIONS: &[&str] = &[
    // ... existing entries ...

    // Granular issue update tools (alongside issue_write composite)
    "update_issue_assignees",
    "update_issue_body",
    "update_issue_labels",
    "update_issue_milestone",
    "update_issue_state",
    "update_issue_title",
    "update_issue_type",
    "set_issue_fields",  // GraphQL: sets org-level custom field values on an issue
];

MCP Tool DIFC Labeling Gaps (tool_rules.rs)

set_issue_fields has no explicit match arm in apply_tool_labels in guards/github-guard/rust-guard/src/labels/tool_rules.rs. It falls through to the default _ => {} handler, which leaves secrecy and integrity at their initial (unscoped) values.

Suggested fix for tool_rules.rs

Add "set_issue_fields" to the existing granular issue write operations match arm:

        // === Granular repo-scoped write operations ===
        "update_issue_assignees"
        | "update_issue_body"
        | "update_issue_labels"
        | "update_issue_milestone"
        | "update_issue_state"
        | "update_issue_title"
        | "update_issue_type"
        | "set_issue_fields"   // ← add this
        | "add_sub_issue"
        // ... rest of match arm unchanged ...
        => {
            secrecy = apply_repo_visibility_secrecy(&owner, &repo, repo_id, secrecy, ctx);
            integrity = writer_integrity(repo_id, ctx);
        }

GitHub CLI-Only Gaps

No new CLI-only gaps detected in this run (45 CLI write commands scanned, same as previous run).

Stale Guard Entries

No stale guard entries detected. All entries in WRITE_OPERATIONS and READ_WRITE_OPERATIONS that are not in the current MCP tool snapshot are either:

• Explicitly marked as pre-emptive (future tools), or
• Deprecated aliases (retained for backward compat during alias transition)

Context

The upstream tool count grew from 82 → 102 (+20 tools) since the last run on 2026-04-13. All 20 new tools are correctly classified and labeled except set_issue_fields.

Tool description from the snap:

"Set issue field values for an issue. Fields are organization-level custom fields (text, number, date, or single select). Use this to create or update field values on an issue."

References

• github-mcp-server tools
• set_issue_fields snap
• guard tools.rs
• guard tool_rules.rs
• Run: 24531509582

Generated by GitHub Guard Coverage Checker (MCP + CLI) · ● 1.5M · ◷

• expires on Apr 30, 2026, 8:16 PM UTC