[veralizeth]

Summary

Add five MCP tools to create, update, delete, list, and get GitHub issue artifacts, gated behind issue_artifacts.

Why

Enable agents to manage issue-attached plans, instructions, references, and other Markdown artifacts. No linked issue.

What changed

• Register artifact tools in the issues toolset behind an explicit, default-off feature flag.
• Add typed inputs/results, partial updates, pagination, validation, tests, and feature documentation.

MCP impact

• No tool or API changes
• Tool schema or behavior changed
• New tool added — create_issue_artifact, update_issue_artifact, delete_issue_artifact, list_issue_artifacts, and get_issue_artifact. Read-only mode exposes only list/get.

Prompts tested (tool changes only)

• “Create a plan artifact on this issue.” — attach an implementation plan.
• “List the artifacts on this issue.” — retrieve attached artifacts.
• “Get this artifact.” — read its metadata and body.
• “Update this artifact’s name and body.” — revise an existing artifact.
• “Delete this artifact.” — remove it from the issue.

Security / limits

• No security or limits impact
• Auth / permissions considered — uses the configured authenticated client; the flag does not grant API access. Endpoint access requirements remain unverified.
• Data exposure, filtering, or token/size limits considered — sanitizes names/bodies, caps pages at 100, and disables all five tools in lockdown mode.

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
  • I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR — adds new tools only.

Note: if you're renaming tools, you must add the tool aliases. For more information on how to do so, please refer to the official docs.

Lint & tests

• Linted locally with ./script/lint — failed on two maps.Copy findings.
• Tested locally with ./script/test — failed on artifact metadata/schema assertions and a nil-client panic.

Passed: go test ./pkg/github -run '^TestIssueArtifact(Requests|Failures)$' -count=1.

Docs

• Not needed
• Updated (README / docs / examples) — documented opt-in, behavior, and restrictions in docs/feature-flags.md.

[Copilot]

🟡 Changes recommended

Provider-incompatible schema constraints and known CI failures still block merging.

6 open issues

• Remove top-level anyOf from update issue artifact schema · New
• Set output schemas on issue artifact tool descriptors · New
• Add missing issue artifact snapshot files · New
• Avoid deep equality on non-nil InstructionsFunc fields · New
• Replace argument-copy loops with maps.Copy · New
• Validate invalid artifact inputs through a registered MCP session · New

What changed in this PR

Adds opt-in issue-artifact management to the GitHub MCP Server’s issues toolset.

Changes:

• Adds five tools to create, update, delete, list, and retrieve issue artifacts.
• Introduces typed inputs/results, pagination, sanitization, and read-only/lockdown restrictions.
• Adds feature gating, behavioral tests, and opt-in documentation.

File	Description
pkg/​github/​tools.go	Registers the five artifact tools.
pkg/​github/​issue_artifacts.go	Implements tool schemas, handlers, validation, and API requests.
pkg/​github/​issue_artifacts_test.go	Adds metadata, feature-gating, request, and error-path tests.
pkg/​github/​issue_artifact_types.go	Defines artifact data and typed inputs/results.
pkg/​github/​feature_flags.go	Declares the issue_artifacts feature flag.
docs/​feature-flags.md	Documents opt-in behavior and restrictions.

_{Review effort: Max}