Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Security alert list tools return inconsistent JSON response shapes

Open Beginner friendly
  • Is something wrong?
#3,439 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 4 days

@ningyixi is already working on this.

Since Oct 14, 2026.

  • #3503 by @ningyixi — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
74/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
go
Domain
api

Research direction

Start with pkg/github/dependabot.go to see the object shape it builds (Alerts plus PageInfo), then compare with the marshalling in pkg/github/code_scanning.go and pkg/github/secret_scanning.go, which emit bare arrays. Update the two list tools to return the same {alerts, pageInfo} contract, adjusting any pagination metadata already available. Done when the existing tests in pkg/github/ for these three list tools pass with the new shape, adding a case asserting the top-level alerts property if none exists.

Written by the indexing model from the issue text.

Description

request ai review
Describe the bug

The security alert list tools expose inconsistent JSON response shapes.

list_code_scanning_alerts and list_secret_scanning_alerts return their text payload as a bare JSON array:

[{"number":274,"rule":{"id":"py/unused-import"}}]

while list_dependabot_alerts returns an object:

{"alerts":[{"number":16}],"pageInfo":{"hasNextPage":false,"hasPreviousPage":false}}

This makes closely related security-list tools difficult to consume uniformly and can cause a client to interpret real findings as an empty result when it expects the Dependabot-style alerts property.

The implementation difference appears to be:

  • pkg/github/code_scanning.go marshals alerts directly
  • pkg/github/secret_scanning.go marshals alerts directly
  • pkg/github/dependabot.go builds an object containing Alerts and PageInfo
Affected version

v1.14.0

Steps to reproduce the behavior
  1. Call list_code_scanning_alerts for a repository with an open finding.
  2. Observe that the text payload is a bare JSON array.
  3. Call list_secret_scanning_alerts and observe the same shape.
  4. Call list_dependabot_alerts and observe { "alerts": [...], "pageInfo": {...} } instead.

We reproduced this during a repository-wide Security & Quality audit. A real open CodeQL finding was present in the returned array but was initially missed by a consumer expecting the Dependabot response shape.

Expected vs actual behavior

Expected: the related security alert list tools expose a consistent top-level contract, preferably { "alerts": [...], "pageInfo": {...} } where pagination metadata applies.

Actual: Code Scanning and Secret Scanning return bare arrays, while Dependabot returns an object.

If the difference is intentional, documenting it explicitly would also help clients avoid incorrect assumptions.

Logs

No server error is produced; this is a response-shape inconsistency.

We currently normalize the two bare-array responses in a local compatibility gateway, but an upstream-consistent contract would remove the need for that workaround.

Dominant language
Go
Stars
33.6k
Forks
5.2k
Avg merge
2d 21h
Merged PRs (30d)
37

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/github-mcp-server

All issues in github/github-mcp-server

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.