[mcp-tools] Restore 4 tools dropped from GitHub MCP toolsets mapping

[github-actions]

Summary

This run of the GitHub MCP Remote Server Tools Report self-inspected the tools actually exposed by the GitHub MCP server in this workflow session and found 4 tools that are live and callable but were missing from pkg/workflow/data/github_toolsets_permissions.json (the v2.3 changelog note claimed they were "removed upstream", which no longer matches reality):

Tool	Restored to toolset
check_dependency_vulnerabilities	security_advisories
run_secret_scanning	secret_protection
semantic_issue_similarity_search	issues
semantic_issues_search	issues

These tools were also independently corroborated by the existing .github/aw/github-mcp-server.md doc, which still listed 3 of the 4 under a stale standalone search toolset section (a scheme the JSON had already moved away from in favor of redistributing search tools into repos/orgs/users).

Changes

• pkg/workflow/data/github_toolsets_permissions.json (v2.3 → v2.4): added the 4 tools above to their toolsets; updated the changelog description.
• .github/aw/github-mcp-server.md:
  • Removed the stale standalone search toolset section; folded search_code/search_commits/search_repositories into repos, search_orgs into orgs, search_users into users, and the two semantic search tools into issues — matching the JSON's current scheme.
  • Added previously-undocumented code_quality (get_code_quality_finding) and copilot (assign_copilot_to_issue, create_pull_request_with_copilot, request_copilot_review) toolset sections, both already present in the JSON mapping but never documented.
  • Bumped Last Updated to 2026-08-02.

Scope note

This workflow session's GitHub MCP tool exposure is read-scoped (the workflow's token only grants read permissions), so write-only tools such as those in copilot, or write methods in repos/issues/pull_requests/etc., could not be independently re-verified this run. Those toolsets/tools were left untouched in the JSON (no removals) since their absence from this session's tool list reflects token scope, not evidence they were removed from the server.

Test plan

• python3 -c "import json; json.load(open(...))" — JSON parses and toolsets/tools remain alphabetically ordered
• Manually cross-checked tool names against this session's live GitHub MCP tool list

---

Warning

Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files. A human must create the pull request manually.

Protected files

• .github/aw/github-mcp-server.md

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission.

Create the pull request manually

# Download the patch from the workflow run
gh run download 30748370383 -n agent -D /tmp/agent-30748370383

# Create a new branch
git checkout -b update-github-mcp-tools-mapping-20260802-2a9c418cc9233dc5 main

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-30748370383/aw-update-github-mcp-tools-mapping-20260802.patch

# Push the branch and create the pull request
git push origin update-github-mcp-tools-mapping-20260802-2a9c418cc9233dc5
gh pr create --title '[mcp-tools] Restore 4 tools dropped from GitHub MCP toolsets mapping' --base main --head update-github-mcp-tools-mapping-20260802-2a9c418cc9233dc5 --repo github/gh-aw

Generated by 📊 GitHub MCP Remote Server Tools Report Generator · agent · 242.1 AIC · ⌖ 19 AIC · ⊞ 11K · ◷

• expires on Aug 4, 2026, 4:56 AM UTC-08:00