[integrity-audit] Integrity Filtering Audit — github/gh-aw-mcpg (2026-09-01)

[github-actions]

Audit period: Last ~70 minutes of activity (most recent 2 pages of completed workflow runs available via the MCP Gateway list_workflow_runs pagination; the API caps at 30 results/page regardless of a 24h time filter, so this is the most recent activity sample obtainable, spanning 2026-09-01T04:45Z–05:56Z)
Runs analyzed: 61 completed runs in github/gh-aw
Runs with artifacts inspected: 2 (deep-dive with full mcp-logs/), plus job-log/artifact-listing checks on 2 more failed runs

Findings Summary

Severity	Count	Description
🔴 Critical	0	No data leaks, guard bypasses, or labeling failures detected
🟡 Warning	1	Zero DIFC integrity/secrecy tags observed in inspected rpc-messages.jsonl (see below)
🟢 Info	5	4 failed agent jobs traced to unrelated script/tooling bugs; repeating action_required pattern; no firewall bypass attempts found

Critical Findings

None found in the sampled runs.

Warnings

W-1 candidate not observed: No direct API bypass attempts (api.github.com, github.com, chatgpt.com, openai.com) were found in firewall audit logs (sandbox/firewall/logs/access.log, audit.jsonl) for either fully-inspected run — 0 DENIED/blocked entries in both.

🟡 Zero/near-zero DIFC integrity tags in RPC logs: For the two runs with complete mcp-logs/ bundles inspected (run 33473888748 "Avenger" and run 33473872843 "Daily Sub-Agent Model Resolution Audit"), rpc-messages.jsonl contained only 2 and 10 lines respectively, with grep -c '"difc_integrity"' returning 0 matches in both. Backend servers used in these runs were limited to safeoutputs and agenticworkflows (internal, non-GitHub-API tool servers) — neither run actually invoked the github MCP server toolset, so the absence of DIFC tags is consistent with "no GitHub API calls made" rather than a labeling failure. No github backend server was registered in tools.json for either run. This should be re-verified against a run that does exercise tools.github before concluding whether DIFC labeling itself is healthy, since neither sampled run exercised the code path DIFC exists to protect.

Informational

• 4 failed agent jobs identified in the sampled window, all traced to causes unrelated to the MCP Gateway/DIFC pipeline:
  • Run 33473888748 ("Avenger"): failed due to gh: Subcommand 'extension' is not permitted (gh CLI policy restriction) and an unrelated PyPy re.error: unbalanced parenthesis in a Python regex used by the agent script. No gateway/guard errors in mcp-gateway.log.
  • Run 33473872843 ("Daily Sub-Agent Model Resolution Audit"): mcp-gateway.log shows clean tool registration (2 succeeded, 0 failed, total tools=17) and normal write-sink guard labeling events (empty resource secrecy — tainted agents blocked, expected behavior for logs writes); process exited with code 1, but no ERROR/WASM-trap entries found in gateway log.
  • Run 33473912396 ("Daily AgentRx Trace Optimizer"): agent artifact contained no mcp-logs/ subdirectory at all and an empty agent_output.json; this run's job apparently did not reach/complete an MCP Gateway session before failing — root cause not in gateway telemetry.
  • Run 33473804293 ("CLI Version Checker"): not deep-dive inspected; artifact listing confirms an agent artifact (100KB) and activation artifact (10MB) exist, consistent with a normal, complete run structure.
  • None of the 4 failures show WASM guard traps (wasm error:, WASM guard trap), guard-not-initialized errors, or unknown-REST-endpoint errors.
• Repeating action_required conclusion observed for workflows named "Q", "Agentic Commands", "Squad", and "AI Moderator" across the sampled window. This is consistent with a normal permission/approval gate (e.g., workflows requiring manual approval for a triggering actor/fork) rather than a DIFC anomaly, but was not exhaustively confirmed against each workflow's configuration.
• write-sink guard behaving as expected: In run 33473872843, guard:write-sink correctly labeled logs write operations as blocked for tainted agents when resource secrecy was empty — this is the guard functioning as designed, not an error.
• No activation-job rate-limit failures (403 API rate limit exceeded for installation) were observed in the sampled window.
• Artifact structure note: mcp-logs/ (containing rpc-messages.jsonl, mcp-gateway.log, gateway.md, proxy.log, tools.json, observed-url-domains.json) is bundled inside the agent artifact, not a separate artifact — useful for future audits to know where to look without downloading activation (which is ~10MB and mostly setup logs).

Runs Analyzed

Run	Workflow	Branch	Agent Invoked	DIFC Events	Firewall Blocks	Status
33473888748	Avenger	main	✅	0/2 rpc lines	0/access.log	⚠️ (unrelated script errors)
33473872843	Daily Sub-Agent Model Resolution Audit	main	✅	0/10 rpc lines	0/access.log	⚠️ (exit 1, no gateway errors)
33473912396	Daily AgentRx Trace Optimizer	main	✅ (no mcp-logs found)	n/a	n/a	⚠️ (root cause outside gateway telemetry)
33473804293	CLI Version Checker	main	✅ (not deep-dived)	n/a	n/a	⚠️ (not inspected in depth)
~57 other runs	various	main	mixed (many skipped/action_required)	not inspected	not inspected	✅ (completed/skipped, not sampled in depth)

Recommendations

1. Re-run this audit against a workflow that actually exercises tools.github (i.e., calls the github MCP backend server) before drawing firm conclusions about DIFC tag health — the two runs with full mcp-logs/ in this sample only used safeoutputs/agenticworkflows servers, so the "0 DIFC events" observation is expected (no GitHub API calls were made), not evidence of a labeling failure. Recommend selecting/triggering a run known to call github-mcp-server tools (e.g., an issue-triage or PR-review workflow) for the next audit cycle.
2. Investigate and fix the 4 unrelated failures found in this window (gh CLI extension subcommand policy block in "Avenger"; PyPy regex unbalanced parenthesis bug in "Avenger"'s model-candidate script; "Daily Sub-Agent Model Resolution Audit" exiting 1 with no visible error in agent-stdio; "Daily AgentRx Trace Optimizer" producing no mcp-logs/ at all, suggesting it may not use the MCP Gateway or exited before gateway startup completed) — these are agent/script bugs, not gateway security issues, but worth triaging separately.
3. No direct API bypass (W-1) findings this cycle — no action needed on shared/mcp-api-routing.md guidance at this time.
4. Given the 30-result/page cap on list_workflow_runs regardless of time-window framing, consider adjusting the audit procedure to page further back (multiple additional pages) to reliably cover a full rolling 24h window rather than ~70 minutes of the most recent activity.

Generated by Integrity Filtering Audit · copilot · auto · 165.1 AIC · ⊞ 13.4K · ◷

• expires on Sep 8, 2026, 6:02 AM UTC