What agents should know before contributing

github/github-mcp-server

GitHub's official MCP Server

Read by Bluet from 7 files written for agents and 300 merged pull requests on 2026-09-25. Not reviewed by the maintainers.

Rules its files tell agents (4)

mustGate on concrete flags, never on cfg.InsidersMode.
Gate on concrete flags, never on cfg.InsidersMode. There is a TestGitHubPackageDoesNotReadInsidersMode guard test that fails if pkg/github reads InsidersMode directly.
docs/insiders-features.md
mustIt expands once at startup into a curated set of individual feature flags, and from that point on every code p…
Insiders is a meta feature flag — the same shape as default or all for toolsets. It expands once at startup into a curated set of individual feature flags, and from that point on every code path keys off concrete flags, never InsidersMode directly. New experimental work should always get its own flag and then be added to the insiders expansion list, never folded into insiders as a catch-all.
docs/insiders-features.md
mustHTTPS Only: Never send requests over plaintext HTTP.
HTTPS Only: Never send requests over plaintext HTTP. Always use HTTPS in production.
docs/host-integration.md
shouldAnything not on the allowlist is silently dropped — flags missing from the allowlist can only be turned on by…
Allowlist filter. User-supplied flags are filtered against AllowedFeatureFlags. Anything not on the allowlist is silently dropped — flags missing from the allowlist can only be turned on by remote-server feature management, not by end users.
docs/insiders-features.md

Decisions its pull requests settled (35)

#2159Add configurable server name and title via translation strings
#2362Fix Content-Type rejection for application/json; charset=utf-8
#2454Add ifc label for get_file_contents tool
#2456Add ifc label for search_issues tool
#2458Add optional `rationale` parameter to `update_issue_type` tool
#2478Replace ingress IFC reader list with private marker
#2505Adding rationale for fields and labels in issues_granular
#2520gate issue-fields features behind remote_mcp_issue_fields flag
#2608Add get_commits method to pull_request_read
#2655support custom listen address
#2660Fix GraphQL call using the wrong case for method derivation
#2710wire stdio OAuth 2.1 login into the server (2/4)
#2766bound pagination to cap latency
#2768Add MCP Server Card (SEP-2127) types + handler
#2774reconcile the show/defer contract — render results, remove show_ui
#2802Add rationale and confidence to closing an issue
#2821Add is_suggestion + rationale to update_issue_assignees
#2881Centralise lockdown author checks
#2900add --authorization-server flag to override OAuth AS URL
#2909Add opt-in intent-aware Copilot issue assignment tool
#2936mark subscription tools destructive
#2964Make search_issues semantic by default
#3020Add non-default find_duplicate tool gated by duplicate_detection flag
#3056Attach GitHub token only to configured GitHub hosts
#3064Return assignees from list_issues
#3109harden pull_request_read get_commits handling
#3111Limit HTTP request bodies before MCP middleware parsing
#3113isolate repo-access cache per caller identity
#3119explain review request denials instead of forwarding a bare 404
#3120make clean text allocation-free on the hot path
#3128Add per-call OAuth scope checks
#3131give create_or_update_file callers a SHA they can actually get
#3146Enable feature flags via URL query parameter (?features=) for headerless hosted connections
#3147preserve CORS across OAuth routes
#3221Return a clear error for missing owner/repo/issue_number in the copilot assignment tools

Your agents can be told this before they touch the code. Get it for your repository: npx bluet-mcp init. What Bluet is.