Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Safe Outputs Conformance] MCE-001: add_comment tool description wording does not match conformance checker 50-link disclosure pattern

Open Beginner friendly
  • Is something wrong?
#68,972 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
68/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
bash, go, json
Domain
devtools

Research direction

The add_comment description and its body field description live in pkg/workflow/js/safe_outputs_tools.json, and the failing regex is in check_mce_constraint_disclosure in scripts/check-safe-outputs-conformance.sh. Start by comparing the current max-links wording with the 50 link pattern the checker greps for, then decide whether to reword the JSON or widen the regex, which maintainers should confirm. Done means the checker reports MCE-001 as passing when run.

Written by the indexing model from the issue text.

Description

automated conformance safe-outputs
Conformance Check Failure

Check ID: MCE-001
Severity: MEDIUM
Category: Implementation (MCP Constraint Enforcement, Section 8.3 MCE2)

Problem Description

scripts/check-safe-outputs-conformance.sh (check check_mce_constraint_disclosure) requires the add_comment tool description in pkg/workflow/js/safe_outputs_tools.json to contain the literal substring 50 link (case-insensitive) as proof that the 50-URL constraint is disclosed to the agent per spec Section 8.3 MCE2.

The description does disclose the limit, but with different wording:

"...the configured max-links URL occurrences in agent content (default: 50; generated footer and metadata links excluded)..."

Because the digit 50 and the word link/links never appear adjacent, the checker's grep -iE "50 link" does not match, and the check fails with a MEDIUM-severity false-positive-style result even though the underlying requirement (informing the agent of the link limit before it calls the tool) is satisfied.

This will keep re-triggering on every scheduled run of this conformance workflow until either the description wording or the checker pattern is adjusted, generating recurring noise.

Affected Components
  • Files:
    • pkg/workflow/js/safe_outputs_tools.json (canonical source, embedded via go:embed in pkg/workflow/safe_outputs_tools.go) — add_comment tool description (~line 525) and body field description (~line 533)
    • scripts/check-safe-outputs-conformance.sh — check_mce_constraint_disclosure (around line 684)
🔍 Current vs Expected Behavior
Current Behavior

The add_comment description states the link limit as "...(default: 50; generated footer and metadata links excluded)" — correct in substance, but it does not contain a string matching 50 link so the automated checker flags it as missing disclosure.

Expected Behavior

Either:

  1. The tool description text explicitly includes a phrase like "maximum 50 links" / "50 link limit" so the disclosure is unambiguous to both the agent and the automated conformance check, OR
  2. The checker's regex is broadened to also accept the existing "max-links ... default: 50" phrasing (and similar equivalent wording) so it does not flag substantively-conformant descriptions.
Remediation Steps

This task can be assigned to a Copilot coding agent with the following steps:

  1. Open pkg/workflow/js/safe_outputs_tools.json and locate the add_comment tool description and its body field description (two occurrences of the max-links wording).
  2. Reword the link-limit clause to literally include "50 links" (or "50 link limit"), e.g. change "...the configured max-links URL occurrences in agent content (default: 50; generated footer and metadata links excluded)..." to "...a maximum of 50 links (configurable via max-links; generated footer and metadata links excluded)...", keeping the meaning unchanged.
  3. Regenerate/sync actions/setup/js/safe_outputs_tools.json from the canonical source if it is a generated copy (check pkg/workflow/safe_outputs_tools_generation.go / generate_safe_outputs_tools.cjs for the regeneration step), and run make fmt.
  4. Re-run the conformance checker to confirm MCE-001 passes.
  5. If, instead, the maintainers prefer to keep the current wording, update the checker regex in scripts/check-safe-outputs-conformance.sh (check_mce_constraint_disclosure) to accept the existing "max-links...default: 50" phrasing instead of requiring the literal "50 link" substring.
Verification

After remediation, verify the fix by running:

bash scripts/check-safe-outputs-conformance.sh

The check MCE-001 should pass without errors.

References
  • Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md (Section 8.3 MCE2)
  • Conformance Checker: scripts/check-safe-outputs-conformance.sh
  • Run ID: §38688391715
  • Date: 2026-10-15

Generated by ✅ Daily Safe Outputs Conformance Checker · claude · agent · 83.3 AIC · ⊞ 5.3K · ◷

  • expires on Oct 15, 2026, 9:49 PM UTC-08:00
Dominant language
Go
Stars
5.4k
Forks
584
Avg merge
3h 56m
Merged PRs (30d)
810

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/gh-aw

All issues in github/gh-aw

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.