Skip to content

docs: installing gh also breaks the surface probe #301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Jammy2211 merged 1 commit into from
Aug 27, 2026
Merged

docs: installing gh also breaks the surface probe #301

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions skills/GITHUB_ACCESS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,15 @@ Because of the second wall, `gh` could not be a drop-in here even if an org
admin connected the GitHub App. The MCP surface is not a workaround for a
missing `gh` — on this surface it is *the* GitHub client. Use the table above.

And installing it does not just waste the effort — **it breaks the probe
above**. `gh auth status` exits 0 in a remote session even as it prints "The
token in GH_TOKEN is invalid": the `proxy-injected` placeholder in `GH_TOKEN`
is enough to satisfy it. So a session that installed `gh` answers its own
decide-once probe with `gh`, reads this page's commands as commands, and walks
straight into the 403s above — the failure mode the probe exists to prevent.
The probe is only honest while `gh` is absent, which is the strongest reason to
leave it that way.

## The mapping

| Operation | `gh` | MCP tool |
Expand Down
Loading