Method applyDefaultTools

pkg/workflow/tools.go:510–695

applyDefaultTools adds default read-only GitHub MCP tools, creating github tool if not present

(tools map[string]any, safeOutputs *SafeOutputsConfig, sandboxConfig *SandboxConfig, networkPermissions *NetworkPermissions)

// applyDefaultTools adds default read-only GitHub MCP tools, creating github tool if not present
func (c *Compiler) applyDefaultTools(tools map[string]any, safeOutputs *SafeOutputsConfig, sandboxConfig *SandboxConfig, networkPermissions *NetworkPermissions) map[string]any {
	toolsLog.Printf("Applying default tools: existingToolCount=%d", len(tools))
	// Always apply default GitHub tools (create github section if it doesn't exist)

	if tools == nil {
		tools = make(map[string]any)
	}

	// Get existing github tool configuration
	githubTool := tools["github"]

	// Check if github is explicitly disabled (github: false)
	if githubTool == false {
		// Remove the github tool entirely when set to false
		delete(tools, "github")
	} else {
		// Process github tool configuration
		var githubConfig map[string]any

		if toolConfig, ok := githubTool.(map[string]any); ok {
			githubConfig = make(map[string]any)
			maps.Copy(githubConfig, toolConfig)
		} else {
			githubConfig = make(map[string]any)
		}

		// Parse the existing GitHub tool configuration for type safety
		parsedConfig := parseGitHubTool(githubTool)

		// Create a set of existing tools for efficient lookup
		existingToolsSet := make(map[string]struct{})
		if parsedConfig != nil {
			for _, tool := range parsedConfig.Allowed {
				existingToolsSet[string(tool)] = struct{}{}
			}
		}

		// Only set allowed tools if explicitly configured
		// Don't add default tools - let the MCP server use all available tools
		if len(existingToolsSet) > 0 {
			// Convert back to []any for the map
			existingAllowed := make([]any, 0, len(parsedConfig.Allowed))
			for _, tool := range parsedConfig.Allowed {
				existingAllowed = append(existingAllowed, string(tool))
			}
			githubConfig["allowed"] = existingAllowed
		}
		tools["github"] = githubConfig
	}

	// Enable edit and bash tools by default when sandbox is enabled
	// The sandbox is enabled when:
	// 1. Explicitly configured via sandbox.agent (awf)
	// 2. Auto-enabled by firewall default enablement (when network restrictions are present)
	if isSandboxEnabled(sandboxConfig, networkPermissions) {
		toolsLog.Print("Sandbox enabled, applying default edit and bash tools")

		// Add edit tool if not present