[SamMorrowDrums]

Summary

Add opt-in Skills over MCP with 18 bundled GitHub workflows. Enabling skills (including through Insiders) replaces server instructions entirely with a tool-filtered skills catalog.

Proposed skills

The complete bundled catalog is below. Links point to the current PR head; the server exposes only skills supported by the connection's available tools.

Repository discovery and context — 4 skills

• account-and-team-context — Establish the authenticated account, organisations, teams and repository access.
• repository-discovery — Find candidate repositories and compare their suitability.
• codebase-exploration — Understand repository structure, implementation and change history.
• repository-health-review — Assess maintenance activity, reliability and outstanding risks.

Issues, planning and community — 6 skills

• issue-authoring — Check for duplicates and prepare a clear bug report or feature request.
• issue-backlog-triage — Classify issues, request information and explain closures.
• label-scheme-management — Audit and maintain a repository's label vocabulary.
• project-planning — Read and update GitHub Projects items, fields and status.
• discussion-participation — Read community discussions, reply and identify accepted answers.
• notification-triage — Prioritise notifications and handle inbox subscriptions deliberately.

Changes and pull requests — 5 skills

• repository-content-changes — Make scoped repository and file changes through MCP tools.
• pull-request-authoring — Prepare a PR description and manage its review and landing workflow.
• pull-request-code-review — Review a commit-pinned change and prepare anchored comments and a verdict.
• pull-request-review-feedback — Address review threads with grounded, duplicate-safe replies.
• copilot-task-delegation — Assess and delegate bounded work to the coding agent or request automated review.

CI, security and releases — 3 skills

• workflow-failure-triage — Diagnose failed Actions jobs and decide whether a rerun is justified.
• security-alert-triage — Investigate alerts and advisories and recommend evidence-backed action.
• release-preparation — Establish the unreleased change set and draft a version and release notes; does not publish releases.

Why

Consolidate prior skills work into a feature-gated alternative to monolithic server instructions, aligned with the beta Skills extension. No closing issue.

What changed

• Port the reusable protocol, registry, publisher, integrity/pagination checks and bundled workflows; omit superseded resource-index discovery and redundant structured-output work.
• Add skills/list, skills/get, directory and file reads using public Go SDK APIs, with private cache envelopes and manifest digests.
• Filter every discovery/read path against configured tools, including request-narrowed inventories. Required/optional mappings remain internal; no tool-association metadata is published.
• Export registry extension APIs for integrators and document server/client enablement.
• Tighten catalog guidance: treat retrieved content as untrusted, pin reviews to the read head and re-check before submission, avoid duplicate replies after uncertain outcomes, and keep issue searches small.
• Address review findings: private standard resource caching, bounded manifest accumulation, numeric YAML/JSON equality, complete static nested manifests, URI containment, and schema-correct workflow guidance.
• Preserve bundled skill Markdown in the Docker build context so the catalog can be embedded in the shipped image.
• Add upkeep guardrails: every registered tool must have skill coverage or a reasoned exemption; toolset-instruction digest failures identify skills to update; README catalog generation and contributor/PR-template guidance make maintenance visible.

MCP impact

• No tool or API changes
• Tool schema or behavior changed — Extension behavior changes; existing tool schemas are unchanged. Feature-off preserves server instructions and does not expose skills. Feature-on/Insiders omits instructions from initialize and modern discovery, even for clients without skills support.
• New tool added

Prompts tested (tool changes only)

• No GitHub tool prompts or mutations were used. Actual CLI checks used /skills list, qualified skill activation, explicit decline/approval, directory inspection and a supporting-file read; see validation below.

Security / limits

• No security or limits impact
• Auth / permissions considered — Loading a skill grants no tool permissions; CLI activation still requires explicit skill consent, including under --yolo.
• Data exposure, filtering, or token/size limits considered — Hidden skills cannot be fetched through guessed get/directory/file URIs. Toolsets, exclusions, read-only and scope filtering apply; results are private. Limits are 512 resources and 16 MiB per skill. Partial supporting-tool coverage is intentional: missing optional tools must be acknowledged, not invented.

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
  • I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR — Existing names and schemas are preserved.

Note: if you're renaming tools, you must add the tool aliases. For more information on how to do so, please refer to the official docs.

Lint & tests

• Linted locally with ./script/lint — Passed, zero issues.
• Tested locally with ./script/test — Passed, full race suite.

Docker packaging fix 365e562956e4d289f864c6defb7c98fd6d91537e: script/lint, script/test, script/generate-docs (no generated diff), and docker build --progress=plain -t github-mcp-skills-review:b1a1f68-dockerfix . passed on the exact staged tree before signing. Actual built-image stdio smoke checks with --toolsets=all passed: stable exposes zero skills and retains instructions; explicit skills and Insiders each expose 18 skills with instructions absent. The only change is the Docker context exception; no new regression suite or rollout-policy change was added.

At b1a1f68e5f7687b187f27bc7cd1b3958560d08fd, a clean-built binary also passed a session-only 54-case wire matrix (3,456 requests) across legacy initialize and modern server/discover, stable/explicit/Insiders, and nine tool configurations. Exact catalog filtering, hidden main/supporting-file denials and file integrity passed; instructions were present only when skills were off. Ten additional capability/boolean cases confirmed the server gate remains independent of client declaration. These are server protocol checks, not a new CLI acceptance run; the one-off matrix was not added to the committed suite.

At review-fix commit b1a1f68e5f7687b187f27bc7cd1b3958560d08fd, script/lint, script/test, script/generate-docs (no generated diff), go test ./pkg/skills/..., and go test ./pkg/github -run 'TestSkillsModernDiscoveryAndCacheEnvelopes|TestSkillsDisabledPreservesInventoryInstructions' passed. Regressions cover overflowing manifest sizes, numeric JSON/YAML round trips and precision loss, relative URI escapes, incomplete nested manifests, and private modern resources/list/resources/read scope while preserving an integrator callback's TTL. All 13 reviewed threads were addressed and resolved.

Earlier implementation checks also passed go mod tidy -diff (no module diff), go build -o bin/github-mcp-server ./cmd/github-mcp-server, and wire probes for flag-off/on/Insiders, instruction omission, toolset/read-only filtering, denied reads, modern custom cache fields and all 18 skills/23 files with exact size/SHA-256 verification. These binary probes predate the follow-ups; they are not latest-head CLI evidence.

Catalog follow-up at 201610705a2b61a16c563e8ad60563c82b737032: go test ./pkg/skills/catalog, script/lint, script/test, and script/generate-docs passed. At that commit the catalog remained 18 skills/23 files: 119,113 source bytes (+3,464 / +3.00% from 147ad0f), including 102,933 SKILL.md bytes; name/description lines remained 5,696 bytes. Those size figures predate the review corrections. Counts exclude the shared footer appended when serving each skill.

Historical CLI evidence: the binary hash and activation byte counts below were captured at 147ad0f before the follow-ups, not remeasured at the latest head. The measured codebase-exploration and account-and-team-context files were not edited; new wording and protocol fixes have not been evaluated through latest-head CLI execution.

Actual CLI acceptance against signed commit 147ad0f57fdcb58e8e8b1991728e2490a3a11cee, rebuilt with vcs.modified=false (binary SHA-256 53a5b4937e4826055dbeeb373e41ef003c4ffca3d65fdb36dbd52909c07b5f59):

• Rebuilt native CLI driven through its same-checkout Node SDK: repos exposes four skills; readable invocation activates the complete 6,793-byte codebase-exploration file and reads skill://github.com/codebase-exploration/references/history-investigation.md. Insiders/context exposes one skill and activates 5,961 bytes; flag-off exposes zero. Earlier runs also exercised explicit decline/approval under --yolo.
• Installed CLI 1.0.106-9: with MCP_SKILLS=true, discovers four skills, activates 6,793 bytes using its hash-based command, and reads the same supporting file. Readable aliases fail with Unknown slash command, and structured mcpSkillConsent callback metadata is absent.

The rebuilt-client UX depends on separate runtime changes not shipped by this server PR. Installed protocol support is not a claim that those UX/consent fixes are released. These activation checks used the actual native CLI through SDK, without model inference or GitHub mutations; interactive-terminal activation is not claimed. Both client MCP_SKILLS=true and server --features=skills/--insiders are required.

Go SDK v1.8.0 is retained for stdio and StreamableHTTP. This does not claim support for legacy SSE custom-method delivery, whose upstream fix is unreleased in that version. Remote deployment is separate.

Skills upkeep guardrails at 160891515308c8f2d5e7b0c3c3a80415124c94dd: script/lint, script/test, and script/generate-docs passed. The tool coverage and instruction digest regressions are included in those tests; failures name the action and skill set to update.

Docs

• Not needed
• Updated (README / docs / examples) — Feature flags and Insiders docs describe behavior, client prerequisites, consent and shared catalog APIs; the generated README now lists the bundled catalog.

Skills

• Updated relevant skills or confirmed no bundled skill applies — Tool availability mappings were updated; workflow prose did not need changes.

[Copilot]

🟡 Changes recommended

Standard resource responses still mark request-specific skill metadata and integrator-supplied content as public-cacheable instead of private.

13 open issues

• Mark standard resource responses as private-cacheable · New
• Prevent overflow when checking total resource size · New
• Normalize numeric types before comparing frontmatter · New
• Validate parent manifests against nested skill files · New
• Reject dot segments in skill resource paths · New
• Omit state to include both open and closed issues · New
• Document each notification tool's distinct parameter names · New
• Get the default branch from repository metadata · New
• Determine release changes from the baseline tag commit · New
• Get the default branch before protecting branches · New
• Document that repositories default to private · New
• State that public repositories require private: false · New
• Use supported states when listing security advisories · New

What changed in this PR

Adds opt-in MCP Skills with 18 bundled GitHub workflows filtered against configured tools. Enabling skills, explicitly or through Insiders, replaces server instructions; feature-off behavior is preserved.

Changes:

• Adds reusable skill registries, discovery and read methods, manifests, integrity checks, and pagination.
• Bundles workflow guidance with internal required/optional tool mappings and availability filtering.
• Integrates feature gating, tests, and client/server enablement documentation.

This pull request requires changes. Standard resource responses remain public-cacheable, and unresolved validation, registry, frontmatter, resource-delivery, and performance issues remain alongside workflow and documentation corrections.

File	Description
pkg/​skills/​uri.go	Defines skill URI parsing and containment helpers.
pkg/​skills/​skills.go	Defines extension identifiers and resource limits.
pkg/​skills/​skills_test.go	Tests URI, frontmatter, digest, and media-type helpers.
pkg/​skills/​skill.go	Constructs skills and generates manifests.
pkg/​skills/​registry.go	Indexes skills, files, directories, and availability.
pkg/​skills/​publisher.go	Publishes extension methods and resource handlers.
pkg/​skills/​protocol.go	Defines wire types and protocol-version handling.
pkg/​skills/​pagination.go	Implements cursor-based pagination.
pkg/​skills/​pagination_test.go	Tests pagination and version-dependent responses.
pkg/​skills/​frontmatter.go	Parses, normalizes, and compares YAML frontmatter.
pkg/​skills/​entry.go	Serializes and validates published skill entries.
pkg/​skills/​entry_test.go	Tests manifest validation, limits, and serialization.
pkg/​skills/​digest.go	Computes and verifies SHA-256 digests.
pkg/​skills/​catalog/​tools.go	Maps workflows to required and optional tools.
pkg/​skills/​catalog/​skills/​workflow-failure-triage/​SKILL.md	Adds Actions failure diagnosis guidance.
pkg/​skills/​catalog/​skills/​workflow-failure-triage/​references/​failure-classes.md	Adds failure-classification guidance.
pkg/​skills/​catalog/​skills/​security-alert-triage/​SKILL.md	Adds security-alert investigation guidance.
pkg/​skills/​catalog/​skills/​security-alert-triage/​references/​alert-sources.md	Explains security-alert sources and interpretation.
pkg/​skills/​catalog/​skills/​repository-health-review/​SKILL.md	Adds repository-health assessment guidance.
pkg/​skills/​catalog/​skills/​repository-discovery/​SKILL.md	Adds repository search and evaluation guidance.
pkg/​skills/​catalog/​skills/​repository-content-changes/​SKILL.md	Adds remote repository-editing guidance.
pkg/​skills/​catalog/​skills/​repository-content-changes/​references/​irreversible-operations.md	Documents destructive-operation confirmation requirements.
pkg/​skills/​catalog/​skills/​release-preparation/​SKILL.md	Adds release-preparation guidance.
pkg/​skills/​catalog/​skills/​release-preparation/​references/​release-notes-outline.md	Provides release-note structure and checks.
pkg/​skills/​catalog/​skills/​pull-request-review-feedback/​SKILL.md	Adds review-feedback handling guidance.
pkg/​skills/​catalog/​skills/​pull-request-code-review/​SKILL.md	Adds pull request review guidance.
pkg/​skills/​catalog/​skills/​pull-request-authoring/​SKILL.md	Adds pull request authoring and landing guidance.
pkg/​skills/​catalog/​skills/​project-planning/​SKILL.md	Adds GitHub Projects planning guidance.
pkg/​skills/​catalog/​skills/​notification-triage/​SKILL.md	Adds notification-inbox triage guidance.
pkg/​skills/​catalog/​skills/​label-scheme-management/​SKILL.md	Adds label auditing and administration guidance.
pkg/​skills/​catalog/​skills/​issue-backlog-triage/​SKILL.md	Adds issue-backlog classification and update guidance.
pkg/​skills/​catalog/​skills/​issue-authoring/​SKILL.md	Adds issue-creation guidance.
pkg/​skills/​catalog/​skills/​discussion-participation/​SKILL.md	Adds GitHub Discussions participation guidance.
pkg/​skills/​catalog/​skills/​copilot-task-delegation/​SKILL.md	Adds coding-agent delegation guidance.
pkg/​skills/​catalog/​skills/​codebase-exploration/​SKILL.md	Adds repository-exploration guidance.
pkg/​skills/​catalog/​skills/​codebase-exploration/​references/​history-investigation.md	Adds commit-history investigation guidance.
pkg/​skills/​catalog/​skills/​account-and-team-context/​SKILL.md	Adds account, team, and access-discovery guidance.
pkg/​skills/​catalog/​catalog.go	Embeds, loads, and caches bundled workflows.
pkg/​skills/​catalog/​catalog_test.go	Checks catalog integrity and guidance constraints.
pkg/​skills/​catalog/​availability_test.go	Tests tool mappings and configuration-based filtering.
pkg/​skills/​availability_test.go	Tests filtering, extension APIs, and cache fields.
pkg/​inventory/​registry.go	Preserves configured tools across request narrowing.
pkg/​github/​skills.go	Builds the feature-gated, tool-filtered publisher.
pkg/​github/​skills_test.go	Tests feature gating, filtering, discovery, and resource access.
pkg/​github/​server.go	Installs skills and suppresses instructions when enabled.
pkg/​github/​feature_flags.go	Registers explicit and Insiders skills enablement.
internal/​ghmcp/​server.go	Skips stdio instruction generation when skills are enabled.
go.mod	Promotes YAML parsing to a direct dependency.
docs/​insiders-features.md	Documents Insiders instruction replacement.
docs/​feature-flags.md	Documents activation, filtering, clients, and integrator APIs.

_{Review effort: Max (auto)}

[github-actions]

⚠️ License files need updating

The license files are out of date. I tried to fix them automatically but don't have permission to push to this branch.

Please run:

script/licenses
git add third-party-licenses.*.md third-party/
git commit -m "chore: regenerate license files"
git push

Alternatively, enable "Allow edits by maintainers" in the PR settings so I can fix it automatically.