Title: add_comment_to_pending_review runs the GraphQL query on a missing required argument instead of validating it · Issue #2718 · github/github-mcp-server · GitHub
Open Graph Title: add_comment_to_pending_review runs the GraphQL query on a missing required argument instead of validating it · Issue #2718 · github/github-mcp-server
X Title: add_comment_to_pending_review runs the GraphQL query on a missing required argument instead of validating it · Issue #2718 · github/github-mcp-server
Description: Describe the bug add_comment_to_pending_review decodes its arguments with mapstructure.WeakDecode and never checks the required ones. An omitted required argument (e.g. owner) is left as the zero value and sent to the GraphQL API, which ...
Open Graph Description: Describe the bug add_comment_to_pending_review decodes its arguments with mapstructure.WeakDecode and never checks the required ones. An omitted required argument (e.g. owner) is left as the zero v...
X Description: Describe the bug add_comment_to_pending_review decodes its arguments with mapstructure.WeakDecode and never checks the required ones. An omitted required argument (e.g. owner) is left as the zero v...
Opengraph URL: https://github.com/github/github-mcp-server/issues/2718
X: @github
Domain: github.com
{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"add_comment_to_pending_review runs the GraphQL query on a missing required argument instead of validating it","articleBody":"### Describe the bug\n\n`add_comment_to_pending_review` decodes its arguments with `mapstructure.WeakDecode` and never checks the required ones. An omitted required argument (e.g. `owner`) is left as the zero value and sent to the GraphQL API, which then fails downstream with a confusing message instead of a clear \"this argument is required\". The other pull request tools (`pull_request_read`, etc.) validate with `RequiredParam`/`RequiredInt`.\n\n### Affected version\n\n```\nVersion: v1.3.0\nCommit: 34227037fc48771baea9af7163e28cb6556ef287\nBuild Date: 2026-06-11T14:16:55Z\n```\n\n### Steps to reproduce the behavior\n\n1. Call `add_comment_to_pending_review` with `owner` omitted, e.g. `{ \"repo\": \"gated-probe\", \"pullNumber\": 1, \"path\": \"f.go\", \"body\": \"x\", \"subjectType\": \"LINE\" }`.\n2. View the output.\n3. The server runs the query with an empty owner and returns:\n ```\n failed to get latest review for current user: Could not resolve to a Repository with the name '/gated-probe'.\n ```\n Nothing indicates that `owner` was the missing required argument.\n\n### Expected vs actual behavior\n\n**Expected:** `missing required parameter: owner` (consistent with the other PR tools), before any API call.\n\n**Actual:** the handler runs on the incomplete input and returns an unrelated downstream repository-resolution error.\n\n### Logs\n\n```\nfailed to get latest review for current user: Could not resolve to a Repository with the name '/gated-probe'.\n```\n\n\u003e Note: the same `WeakDecode`-without-validation pattern also exists in `copilot.go` and `discussions.go` — happy to follow up separately.","author":{"url":"https://github.com/gustavo-sec","@type":"Person","name":"gustavo-sec"},"datePublished":"2026-06-17T13:35:35.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/2718/github-mcp-server/issues/2718"}
| route-pattern | /_view_fragments/issues/show/:user_id/:repository/:id/issue_layout(.:format) |
| route-controller | voltron_issues_fragments |
| route-action | issue_layout |
| fetch-nonce | v2:eb29fe73-1266-e7e6-2518-0a30dafdcab2 |
| current-catalog-service-hash | 81bb79d38c15960b92d99bca9288a9108c7a47b18f2423d0f6438c5b7bcd2114 |
| request-id | 9B12:F3B55:36719C5:4C6F9BC:6A5F909C |
| html-safe-nonce | f7b02e7f40c38091d910725dde1007635792872c1b56d98fdf3a522681b7d16f |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI5QjEyOkYzQjU1OjM2NzE5QzU6NEM2RjlCQzo2QTVGOTA5QyIsInZpc2l0b3JfaWQiOiIzMzc4NzEyMzc2ODE2NjY4ODI4IiwicmVnaW9uX2VkZ2UiOiJpYWQiLCJyZWdpb25fcmVuZGVyIjoiaWFkIn0= |
| visitor-hmac | 406143981ab729c06cf843c7217d873f265fdbe676c1326e4985982135a1d91d |
| hovercard-subject-tag | issue:4683772975 |
| github-keyboard-shortcuts | repository,issues,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/_view_fragments/issues/show/github/github-mcp-server/2718/issue_layout |
| twitter:image | https://opengraph.githubassets.com/09d4c8da8410c6bcdb775772afc9a09e56aba6eb2d092a1b4ab73c51c2b6a86e/github/github-mcp-server/issues/2718 |
| twitter:card | summary_large_image |
| og:image | https://opengraph.githubassets.com/09d4c8da8410c6bcdb775772afc9a09e56aba6eb2d092a1b4ab73c51c2b6a86e/github/github-mcp-server/issues/2718 |
| og:image:alt | Describe the bug add_comment_to_pending_review decodes its arguments with mapstructure.WeakDecode and never checks the required ones. An omitted required argument (e.g. owner) is left as the zero v... |
| og:image:width | 1200 |
| og:image:height | 600 |
| og:site_name | GitHub |
| og:type | object |
| og:author:username | gustavo-sec |
| hostname | github.com |
| expected-hostname | github.com |
| None | 419b66b5f218029570caa18c30987e7dbabe4f5a6767918b33a504d02739c9c7 |
| turbo-cache-control | no-preview |
| go-import | github.com/github/github-mcp-server git https://github.com/github/github-mcp-server.git |
| octolytics-dimension-user_id | 9919 |
| octolytics-dimension-user_login | github |
| octolytics-dimension-repository_id | 942771284 |
| octolytics-dimension-repository_nwo | github/github-mcp-server |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 942771284 |
| octolytics-dimension-repository_network_root_nwo | github/github-mcp-server |
| turbo-body-classes | logged-out env-production page-responsive |
| disable-turbo | false |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | de5b18aa36dbc0b61e03aeb111e84e90fde499b8 |
| ui-target | canary-1 |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width