feat: add Gitea issue comment list/create MCP tools (#126) #127

2026-07-03T18:08:10-05:00

jcwalker3 commented

2026-07-03 18:08:10 -05:00

Summary

Implements #126: first-class MCP tools for Gitea issue discussion comments, closing the gap where operators had to fall back to direct API scripts (as happened for mcp-control-plane #24).

New tools

gitea_list_issue_comments(issue_number, limit, remote, host, org, repo) — lists an issue's discussion comments. Returns comment id, author, created_at, updated_at, body. Gated on gitea.read (fail closed, no API call when blocked).
gitea_create_issue_comment(issue_number, body, remote, host, org, repo) — posts a markdown comment to the issue thread. Returns comment_id + issue_number. Gated on gitea.issue.comment — separately from the gitea.pr.* review/merge family; a profile holding full PR review permissions cannot post issue comments and vice versa. Empty body blocked. Audit-logged as create_issue_comment when GITEA_AUDIT_LOG is configured.

Safety

Issue comments never touch /pulls/{n}/reviews — endpoint separation is tested.
Normal output is LLM-safe: no endpoint URLs; comment web links appear only under the GITEA_MCP_REVEAL_ENDPOINTS=1 admin opt-in (consistent with #120; forward-compatible with #125).
Errors are passed through _redact before being raised.
Explicit issue_number required; repo targeting uses only the standard remote/org/repo arguments.
No tokens, keychain IDs, or credential material anywhere in the diff; test fixtures are synthetic.

Tests

TestIssueCommentTools — 14 new tests: list/create success, output redaction by default, reveal opt-in, permission blocks (missing read, PR-review-perms-don't-grant-issue-comments, forbidden-overrides-allowed), empty body, missing issue with redacted error, review-endpoint separation, unknown remote.

Full suite: 481 passed, 6 skipped. git diff --check clean; py_compile clean.

Docs

New section "Issue comments versus PR reviews (#126)" in docs/gitea-execution-profiles.md.

Follow-up for operator

The live prgs-author profile does not currently allow gitea.issue.comment, so the create tool will fail closed until the operator adds that operation to the intended profiles in the live config (config change is operator-owned; not part of this PR).

Closes #126

## Summary Implements #126: first-class MCP tools for Gitea issue discussion comments, closing the gap where operators had to fall back to direct API scripts (as happened for mcp-control-plane #24). ## New tools - **`gitea_list_issue_comments(issue_number, limit, remote, host, org, repo)`** — lists an issue's discussion comments. Returns comment `id`, `author`, `created_at`, `updated_at`, `body`. Gated on `gitea.read` (fail closed, no API call when blocked). - **`gitea_create_issue_comment(issue_number, body, remote, host, org, repo)`** — posts a markdown comment to the issue thread. Returns `comment_id` + `issue_number`. Gated on `gitea.issue.comment` — separately from the `gitea.pr.*` review/merge family; a profile holding full PR review permissions cannot post issue comments and vice versa. Empty body blocked. Audit-logged as `create_issue_comment` when `GITEA_AUDIT_LOG` is configured. ## Safety - Issue comments never touch `/pulls/{n}/reviews` — endpoint separation is tested. - Normal output is LLM-safe: no endpoint URLs; comment web links appear only under the `GITEA_MCP_REVEAL_ENDPOINTS=1` admin opt-in (consistent with #120; forward-compatible with #125). - Errors are passed through `_redact` before being raised. - Explicit `issue_number` required; repo targeting uses only the standard remote/org/repo arguments. - No tokens, keychain IDs, or credential material anywhere in the diff; test fixtures are synthetic. ## Tests `TestIssueCommentTools` — 14 new tests: list/create success, output redaction by default, reveal opt-in, permission blocks (missing read, PR-review-perms-don't-grant-issue-comments, forbidden-overrides-allowed), empty body, missing issue with redacted error, review-endpoint separation, unknown remote. Full suite: **481 passed, 6 skipped**. `git diff --check` clean; `py_compile` clean. ## Docs New section "Issue comments versus PR reviews (#126)" in `docs/gitea-execution-profiles.md`. ## Follow-up for operator The live `prgs-author` profile does not currently allow `gitea.issue.comment`, so the create tool will fail closed until the operator adds that operation to the intended profiles in the live config (config change is operator-owned; not part of this PR). Closes #126

jcwalker3 added 1 commit 2026-07-03 18:08:10 -05:00

feat: add Gitea issue comment list/create MCP tools (#126 ) 5aeb51f132

Add gitea_list_issue_comments and gitea_create_issue_comment so
discussion/design workflows can read and post issue comments through
the MCP layer instead of direct API scripts.

- List requires gitea.read; create requires gitea.issue.comment —
  gated separately from the gitea.pr.* review/merge family, fail closed.
- Issue comments never touch PR review endpoints.
- LLM-safe output: comment id/author/timestamps/body only; web links
  appear solely under the GITEA_MCP_REVEAL_ENDPOINTS admin opt-in.
- Create operations are audit-logged (create_issue_comment) and errors
  are redacted before being raised.
- Tests cover list/create success, permission blocks (including PR
  review permissions not granting issue comments), forbidden-overrides,
  empty body, missing issue with redacted error, endpoint separation,
  and reveal opt-in.
- Document issue comments versus PR reviews in
  docs/gitea-execution-profiles.md.

Closes #126

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sysadmin reviewed 2026-07-03 18:11:55 -05:00

sysadmin left a comment

Independent review of PR #127 at pinned head 5aeb51f132.

Validation performed in a clean detached review worktree:

Changed-file scope matched exactly: mcp_server.py, tests/test_mcp_server.py, docs/gitea-execution-profiles.md.
Targeted issue-comment tests: 14 passed.
Full test suite: 481 passed, 6 skipped.
py_compile for mcp_server.py and tests/test_mcp_server.py: passed.
git diff --check against master: passed.

Manual review notes:

gitea_list_issue_comments is gated by gitea.read.
gitea_create_issue_comment is gated separately by gitea.issue.comment.
PR review/merge permissions do not grant issue-comment creation.
Permission-blocked and empty-body paths return before auth/API calls.
Issue comments use the issue comments endpoint, not PR review endpoints.
Create uses audit logging when audit logging is configured.
Errors are passed through the existing redaction helper.
Comment web links are hidden by default and only included under the endpoint reveal opt-in.
No committed tokens, service credentials, raw keychain IDs, or unintended secret material found in the diff.

Verdict: approve.

Independent review of PR #127 at pinned head 5aeb51f13201c9bc3317e9e72faba9c6fdfb703f. Validation performed in a clean detached review worktree: - Changed-file scope matched exactly: mcp_server.py, tests/test_mcp_server.py, docs/gitea-execution-profiles.md. - Targeted issue-comment tests: 14 passed. - Full test suite: 481 passed, 6 skipped. - py_compile for mcp_server.py and tests/test_mcp_server.py: passed. - git diff --check against master: passed. Manual review notes: - gitea_list_issue_comments is gated by gitea.read. - gitea_create_issue_comment is gated separately by gitea.issue.comment. - PR review/merge permissions do not grant issue-comment creation. - Permission-blocked and empty-body paths return before auth/API calls. - Issue comments use the issue comments endpoint, not PR review endpoints. - Create uses audit logging when audit logging is configured. - Errors are passed through the existing redaction helper. - Comment web links are hidden by default and only included under the endpoint reveal opt-in. - No committed tokens, service credentials, raw keychain IDs, or unintended secret material found in the diff. Verdict: approve.

sysadmin merged commit 349bc06da7 into master

2026-07-03 18:40:39 -05:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#127