Enforce JSON Schema format constraints

[Copilot]

JSON Schema format keywords, including URI validation, were annotation-only under the default Draft 2020-12 behavior. Gateway and custom server schemas can now enforce their declared format constraints.

• Strict format validation

  • Enable AssertFormat() in the shared JSON Schema compiler constructor.
  • Covers embedded gateway schemas and custom schemas with remote $ref loaders.

• Regression coverage

  • Verify invalid URI values fail validation in both compiler construction paths.
  • Verify valid HTTPS URIs remain accepted.

compiler := jsonschema.NewCompiler()
compiler.AssertFormat()

• Fixes [go-fan] Go Module Review: santhosh-tekuri/jsonschema/v6 #13350

[Copilot]

🟢 Approval recommended

The centralized change correctly covers both compiler paths with focused regression tests.

Pull request overview

Enforces JSON Schema format constraints across embedded gateway and custom server schemas.

Changes:

• Enables AssertFormat() in the shared compiler.
• Adds URI validation regression tests for both compiler paths.

File summaries

File	Description
internal/config/validation_schema.go	Enables strict format validation.
internal/config/validation_schema_test.go	Tests invalid and valid URI handling.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced (auto)

Note

Copilot is running an experiment and ran this review at Balanced.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[lpcox]

@copilot fix the failing ci check https://github.com/github/gh-aw-mcpg/actions/runs/35230497069/job/105255664570?pr=13363

[Copilot]

@copilot fix the failing ci check https://github.com/github/gh-aw-mcpg/actions/runs/35230497069/job/105255664570?pr=13363

Fixed in the latest commit — the lint failure was testifylint's require-error rule on internal/config/validation_schema_test.go:32; the error assertions now use require.Error/require.NoError. make lint and go test ./internal/config/ pass locally.

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (add_issue_comment/star_repository/issue_write/create_branch/create_or_update_file/create_pull_request)	all "Unknown command" — tool catalog contains only 23 read-only tools, none of the 6 write targets are exposed	BLOCKED	⚠️ INCONCLUSIVE — absent from catalog, not a call-time gateway refusal
C	CLI	reads (github CLI proxy: list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	not tested — gh unauthenticated (no GH_TOKEN in this job)	BLOCKED	⚠️ INCONCLUSIVE
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	not tested — gh unauthenticated	BLOCKED	⚠️ INCONCLUSIVE

Overall: INCONCLUSIVE

No write leaked through any surface. Part B is inconclusive because the gateway's exposed MCP tool catalog for this workflow contains only 23 read tools (get_commit, get_file_contents, get_label, get_latest_release, get_release_by_tag, get_tag, issue_read, list_branches, list_commits, list_issue_fields, list_issue_types, list_issues, list_pull_requests, list_releases, list_repository_collaborators, list_starred_repositories, list_tags, pull_request_read, search_code, search_commits, search_issues, search_pull_requests, search_repositories) — the 6 targeted write tools are absent entirely, so the write path never reaches a call-time gateway/DIFC check to confirm enforcement (as anticipated by the architectural note: GITHUB_READ_ONLY=1 is always set for tools.github:). Parts D/E are inconclusive because gh is not authenticated in this job (no GH_TOKEN), so the REST/GraphQL write-boundary via GitHub token scope could not be exercised. No regression evidence found; independent mcpg DIFC/guard write-blocking is covered by internal/guard and internal/difc unit tests, not this surface.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gvisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gvisor

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tool absent from catalog ("unknown tool")	BLOCKED	⚠️
C	CLI	reads	data	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh unauthenticated — not attempted	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated — not attempted	BLOCKED	⚠️

Overall: INCONCLUSIVE

Details:

• Part A/C: all 4 MCP reads (list_issues, list_pull_requests, get_file_contents, list_commits) and CLI-proxied equivalents returned real data.
• Part B: the exposed catalog (23 tools) contains only reads; issue_write, star_repository, add_issue_comment, create_branch, create_or_update_file, create_pull_request all returned -32602 unknown tool. This confirms backend/toolset config (gh-aw's GITHUB_READ_ONLY=1) but does not independently exercise mcpg's own gateway-level DIFC/guard blocking layer, since no write-capable tool was ever reachable to refuse at call-time.
• Part D/E: gh auth status reported "You are not logged into any GitHub hosts" — REST/GraphQL write attempts were skipped per the safety instructions rather than risk unauthenticated-401 false positives.
• No write of any kind (reaction, star, issue, comment, branch, file, PR) leaked through any surface in this run.

No security gap found; result is INCONCLUSIVE only due to test-surface limitations (absent write tools in catalog, unauthenticated gh), not a confirmed failure.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime