(allowedTools []string, safeOutputs *SafeOutputsConfig)
| 391 | } |
| 392 | |
| 393 | func appendSafeOutputsTools(allowedTools []string, safeOutputs *SafeOutputsConfig) []string { |
| 394 | if safeOutputs == nil { |
| 395 | return allowedTools |
| 396 | } |
| 397 | allowedTools = append(allowedTools, "mcp__"+string(constants.SafeOutputsMCPServerID)) |
| 398 | if !slices.Contains(allowedTools, "Write") { |
| 399 | // Ideally we would grant Write only for the exact safe outputs file, but Claude |
| 400 | // doesn't currently honor that scoped grant reliably. |
| 401 | // See: https://github.com/github/gh-aw/issues/244#issuecomment-3240319103 |
| 402 | allowedTools = append(allowedTools, "Write") |
| 403 | } |
| 404 | return allowedTools |
| 405 | } |
| 406 | |
| 407 | func appendMCPScriptsTools(allowedTools []string, mcpScripts *MCPScriptsConfig) []string { |
| 408 | if HasMCPScripts(mcpScripts) { |
no outgoing calls
no test coverage detected