You signed in with another tab or window.Reload to refresh your session.You signed out in another tab or window.Reload to refresh your session.You switched accounts on another tab or window.Reload to refresh your session.Dismiss alert
* Apply lockdown mode to issues and pull requests* Add cache* Unlock in defer* Add muesli/cache2go* [WIP] Replace custom cache in lockdown.go with cache2go struct (#1425)* Initial plan* Replace custom cache with cache2go library- Added github.com/muesli/cache2go dependency- Replaced custom map-based cache with cache2go.CacheTable- Removed manual timer management (scheduleExpiry, ensureEntry methods)- Removed timer field from repoAccessCacheEntry struct- Updated GetRepoAccessInfo to use cache2go's Value() and Add() methods- Updated SetTTL to flush and re-add entries with new TTL- Used unique cache names per instance to avoid test interference- All existing tests pass with the new implementationCo-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>* Final verification completeCo-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>---------Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>* Use muesli for cache* Make RepoAccessCache a singleton (#1426)* Initial plan* Implement RepoAccessCache as a singleton patternCo-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>* Complete singleton implementation and verificationCo-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>* Remove cacheIDCounter as requestedCo-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>---------Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>Co-authored-by: JoannaaKL <67866556+JoannaaKL@users.noreply.github.com>* Update mutexes* .* Reuse cache* .* .* Fix logic after vibe coding* Update docs* .* Refactoring to make the code pretty* Hide lockdown logic behind shouldFilter function* .* Tests---------Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Copy file name to clipboardExpand all lines: README.md
+15-2Lines changed: 15 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1264,7 +1264,7 @@ docker run -i --rm \
1264
1264
1265
1265
##Lockdown Mode
1266
1266
1267
-
Lockdown mode limits the content that the server will surface from public repositories. When enabled,requests that fetch issue details will return an error iftheissue was created by someone who does not havepush access to the repository. Private repositories are unaffected, and collaboratorscan still access their ownissues.
1267
+
Lockdown mode limits the content that the server will surface from public repositories. When enabled,the server checks whethertheauthor of each item haspush access to the repository. Private repositories are unaffected, and collaboratorskeep full accesstotheir owncontent.
1268
1268
1269
1269
```bash
1270
1270
./github-mcp-server --lockdown-mode
@@ -1279,7 +1279,20 @@ docker run -i --rm \
1279
1279
ghcr.io/github/github-mcp-server
1280
1280
```
1281
1281
1282
-
At the moment lockdown mode applies to the issue read toolset, but it is designed to extend to additional data surfaces over time.
1282
+
The behavior of lockdown mode depends on the tool invoked.
1283
+
1284
+
Following tools will return an error when the author lacks the push access:
1285
+
1286
+
-`issue_read:get`
1287
+
-`pull_request_read:get`
1288
+
1289
+
Following tools will filter out content from users lacking the push access: