[log] Add debug logging to guard_visibility.go

[github-actions]

Summary

Adds meaningful debug logging calls to internal/server/guard_visibility.go, reusing the existing logGuardInit logger (namespace server:guard_init) already used throughout this package.

Changes

• getTrustedBots: logs the number of trusted bots configured for the gateway.
• isServerExemptFromSinkVisibility: logs which exemption path (blanket forcePublicRepos opt-out or SinkVisibilityExemptServers entry) applied for a given server.

No new logger declaration was needed - the file already imports internal/logger and the package-level logGuardInit variable (declared in guard_init.go) is reused for consistency.

Validation

• go build ./... - succeeds
• go vet ./internal/server/... - clean
• go test ./internal/server/... - passes

Notes

An earlier candidate file (internal/syncutil/ttl_cache.go) was considered but rejected: adding a logger import there creates an import cycle, since internal/logger already imports internal/syncutil.

Generated by Go Logger Enhancement · auto · 89.3 AIC · ⊞ 12.4K · ◷

[Copilot]

🟢 Ready to approve

The logging is accurate, scoped to existing behavior, and uses the established logger.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Adds targeted diagnostics for guard visibility configuration.

Changes:

• Logs the configured trusted-bot count.
• Logs why a server is exempt from sink-visibility enforcement.

File summaries

File	Description
internal/server/guard_visibility.go	Adds debug logging for trusted bots and exemption paths.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool	BLOCKED	✅
C	CLI	reads	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh: no GH_TOKEN	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh: no GH_TOKEN	BLOCKED	✅

Gateway enforcement (Part B): Gateway exposes only 22 read-only tools; write calls return Error [-32602]: unknown tool "<name>" — a gateway-specific MCP error.

Overall: PASS ✅

Run §31057249688

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	[-32602]: unknown tool	BLOCKED	✅
C	CLI	reads (list_issues/get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	Bad credentials 401	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	Bad credentials 401	BLOCKED	✅

Overall: PASS

Notes:

• Part B: gateway returns MCP error [-32602]: unknown tool for all write tools — gateway-level enforcement confirmed.
• Parts D/E: gh CLI unauthenticated — writes rejected at GitHub API layer (401).

References: §31057249866

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime