Strip GitHub write MCP tools from non-RCA chat sessions by totto · Pull Request #524 · Arvo-AI/aurora

totto · 2026-06-17T17:11:46Z

Summary

ModeAccessController.filter_tools() only gates tools in "ask" mode. Non-RCA sessions running in "agent" or default mode were getting raw GitHub write MCP tools (create_or_update_file, push_files, create_branch, etc.) without the structured github_fix guardrails that RCA sessions use. This was a contributing factor in the staging incident (PR #513).

The fix adds a _GITHUB_MCP_WRITE_TOOLS frozenset (defined alongside the existing _NON_RCA_SOURCES constant) and strips those tools in get_cloud_tools() when is_rca_context is False. RCA sessions continue to receive all tools.

Test plan

Verify non-RCA interactive chat session does not have mcp_create_or_update_file, mcp_push_files, or mcp_create_branch in its tool list
Verify RCA background session retains all MCP tools including write tools
Verify log message "Stripped N GitHub write MCP tools from non-RCA session" appears for non-RCA sessions with GitHub connected
Verify read-only MCP tools (mcp_get_file_contents, mcp_list_commits, etc.) are still available in non-RCA sessions

Closes #522

Summary by CodeRabbit

Bug Fixes
- Restricted certain GitHub write operations to Root Cause Analysis (RCA) sessions only. Non-RCA users will no longer have access to these tools, with enhanced logging showing how many tools are filtered per session.

Non-RCA sessions (interactive chat, ask, actions) were loading raw GitHub write MCP tools (create_or_update_file, push_files, create_branch, etc.) that bypass both ModeAccessController and the structured github_fix guardrails. This allowed the staging incident where a non-RCA session pushed a truncated file directly via create_or_update_file (PR Arvo-AI#513). ModeAccessController only gates "ask" mode, so non-RCA sessions running in "agent" or default mode had unrestricted access to destructive GitHub MCP tools. The fix adds a post-load filter in get_cloud_tools() that removes GitHub write MCP tools when is_rca_context is False. RCA sessions continue to receive all tools (including the github_fix flow). The _GITHUB_MCP_WRITE_TOOLS frozenset is defined alongside the existing _NON_RCA_SOURCES constant for discoverability. Closes Arvo-AI#522 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

coderabbitai · 2026-06-17T17:12:07Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: f71ed910-4b8c-4754-a49c-fc84c9baf4be

📥 Commits

Reviewing files that changed from the base of the PR and between 659f7ec and e8fc896.

📒 Files selected for processing (1)

server/chat/backend/agent/tools/cloud_tools.py

Walkthrough

A frozenset _GITHUB_MCP_WRITE_TOOLS is added to cloud_tools.py listing GitHub MCP write-tool names. Inside get_cloud_tools(), when is_rca_context is false, any MCP tool whose name appears in that frozenset is removed from the registered tool list, with logging of the removed count.

Changes

GitHub MCP Write Tool Gating

Layer / File(s)	Summary
Write-tool constant and RCA filter `server/chat/backend/agent/tools/cloud_tools.py`	Defines `_GITHUB_MCP_WRITE_TOOLS` as a frozenset of GitHub write-tool names, then filters MCP tools against that set in `get_cloud_tools()` when `is_rca_context` is false, logging the number of tools dropped per session.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

Arvo-AI/aurora#475: Also modifies cloud_tools.py to gate a GitHub tool (github_fix) based on RCA context, directly preceding this write-tool gating pattern.

Poem

🐇 Hop, hop, the rabbit guards the gate,
No push_files shall pass — that's quite the fate!
Write tools locked behind the RCA door,
Non-RCA sessions get read-only, no more.
The frozenset stands firm, the logs confirm,
Safe code lives on — no files to burn! 🔒

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: filtering GitHub write MCP tools from non-RCA sessions for security.
Linked Issues check	✅ Passed	The PR implementation addresses all three key objectives from `#522`: prevents non-RCA sessions from loading write tools, ensures tools go through proper controls, and adds logging for visibility.
Out of Scope Changes check	✅ Passed	The changes are strictly scoped to filtering GitHub write MCP tools in non-RCA contexts, directly addressing the security vulnerability documented in `#522`.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

sonarqubecloud · 2026-06-17T17:13:05Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

beng360

Correct approach. Two issues to address.

beng360 · 2026-06-18T16:47:34Z

+    "mcp_create_or_update_file",
+    "mcp_push_files",
+    "mcp_create_branch",
+    "mcp_create_pull_request",


The frozenset should also include mcp_create_or_update_file_with_pr — this tool variant exists in the GitHub MCP server and also does writes. Check get_github_tool_schemas() in mcp_schema_extractor.py for the full list of write tools exposed. Missing one here means the guard has a bypass.

beng360 · 2026-06-18T16:47:34Z

+            # write tools that bypass ModeAccessController and github_fix.
+            if not is_rca_context:
+                before_count = len(mcp_tools)
+                mcp_tools = [


This filter runs before ModeAccessController.filter_tools() at line 2602, which is fine — but the log message should include the mode so we can distinguish ask-mode filtering (which also strips MCP tools) from this RCA-context filter in debugging. Something like "Stripped %d GitHub write MCP tools from non-RCA session (user=%s, mode=%s)".

beng360 · 2026-06-20T19:56:33Z

Hi! Thanks for your contribution. Before we can merge this, we need you to sign our Contributor License Agreement (CLA) for legal purposes. This is a one-time requirement for external contributors — it ensures that contributions are properly licensed and that both parties are protected.

I'll send the document separately. Once signed, we're good to go on this and any future PRs.

totto requested a review from a team as a code owner June 17, 2026 17:11

beng360 requested changes Jun 18, 2026

View reviewed changes

beng360 added the external contributor PR from an external contributor label Jun 20, 2026

Navigation Menu

Uh oh!

Strip GitHub write MCP tools from non-RCA chat sessions - #524

Strip GitHub write MCP tools from non-RCA chat sessions#524
totto wants to merge 1 commit into
Arvo-AI:mainfrom
totto:bugfix/522-non-rca-write-controls

totto commented Jun 17, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Jun 17, 2026

Uh oh!

beng360 left a comment

Uh oh!

beng360 Jun 18, 2026

Uh oh!

beng360 Jun 18, 2026

Uh oh!

beng360 commented Jun 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

totto commented Jun 17, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Poem

Uh oh!

sonarqubecloud Bot commented Jun 17, 2026

Quality Gate passed

Uh oh!

beng360 left a comment

Choose a reason for hiding this comment

Uh oh!

beng360 Jun 18, 2026

Choose a reason for hiding this comment

Uh oh!

beng360 Jun 18, 2026

Choose a reason for hiding this comment

Uh oh!

beng360 commented Jun 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

totto commented Jun 17, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 17, 2026 •

edited

Loading