[integrity-audit] Integrity Filtering Audit — 2026-09-23 (last 24h)

[github-actions]

Integrity Filtering Audit — github/gh-aw-mcpg

Audit period: Last 24 hours (2026-09-22 05:57 UTC → 2026-09-23 05:57 UTC)
Runs analyzed: 17 completed runs in github/gh-aw (of ~40,000 total historical runs); artifacts sampled for 6 representative runs across success/failure/schedule/PR-event types
Runs with artifacts: 6 (Daily VulnHunter Scan, Daily AgentRx Trace Optimizer, GitHub Remote MCP Authentication Test, PR Sous Chef, plus job-level inspection of Daily PR Code Quality Review and Issue Monster)

Findings Summary

Severity	Count	Description
🔴 Critical	0	No data leaks, guard bypasses, or labeling failures found
🟡 Warning	2	Firewall-blocked direct-network attempts (git CLI → github.com, and an outbound ab.chatgpt.com connection) surfaced by the sandbox firewall, not DIFC itself
🟢 Info	4	Healthy DIFC labeling/filtering behavior, one activation-level (non-agent) failure, one intentional out-of-gateway canary test failure

Critical Findings

None identified. No out-of-scope repository data was observed in any inspected rpc-messages.jsonl, and no WASM guard traps (wasm error:/unreachable) or [ERROR] guard-initialization failures appeared in any sampled mcp-gateway.log.

Warnings

W-1a: Direct github.com CONNECT attempts blocked by sandbox firewall (git CLI, not agent-initiated bypass)

• Run: PR Sous Chef — 35823608396
• Evidence: sandbox/firewall/logs/audit.jsonl shows 2× TCP_DENIED for host=github.com:443 with access.log user-agent git/2.55.0 (agent ran git checkout <branch> against the https://github.com/github/gh-aw.git remote inside the sandboxed workspace).
• Root cause: The agent's own git tooling defaults to the public HTTPS remote instead of the pre-configured local/proxied remote; the firewall correctly denied it (fatal: unable to access 'https://github.com/github/gh-aw.git/': server certificate verification failed), so no data left the sandbox and the git command failed cleanly.
• This is not a DIFC/MCP Gateway bypass (git, not curl/fetch, and blocked before any data transferred) but is worth tracking because repeated blocked git operations waste agent turns and could mask a misconfigured git remote.
• Recommended fix: Ensure workflows that need git fetch/checkout against github.com configure the git remote to route through the sandboxed proxy (or pre-fetch refs via the MCP Gateway github tool) rather than relying on git's default HTTPS remote.

W-1b: Direct ab.chatgpt.com CONNECT attempt blocked by sandbox firewall

• Run: GitHub Remote MCP Authentication Test — 35822724588
• Evidence: sandbox/firewall/logs/audit.jsonl shows 1× TCP_DENIED for host=ab.chatgpt.com:443 from the agent container (client=172.30.0.20), occurring seconds after a successful api.githubcopilot.com connection.
• Likely cause: background telemetry/analytics call embedded in a tool or dependency (ab.chatgpt.com is an OpenAI/ChatGPT analytics subdomain), not an explicit agent action — no corresponding tool call or prompt instruction referenced it in agent-stdio.log.
• Correctly blocked by firewall policy; no data exfiltrated. Recommended fix: no change required, but if this domain recurs across runs, consider explicitly documenting it in the firewall's known-blocked list so future audits can quickly classify it as expected noise.

Informational

• Daily VulnHunter Scan (35823623920): success. DIFC auto-enabled with allow-only: {min-integrity: approved, repos: public}; FORCED REPOS=PUBLIC correctly applied since github/gh-aw is public. No [ERROR] lines, 0 DIFC-filtered events (scan only read code, no issue/PR data). One transient TCP_DENIED for api.anthropic.com immediately followed by a successful TCP_TUNNEL retry — normal retry/backoff behavior, not a policy violation.
• GitHub Remote MCP Authentication Test (35822724588): failure, but only because of its separate raw_mcp_canary job, which deliberately makes a raw curl call to api.githubcopilot.com (by design, to test the remote MCP endpoint outside the gateway) and hit HTTP 429 Too Many Requests. The agent job itself succeeded: DIFC correctly labeled the agent's integrity as ["none:public","unapproved:public","approved:public"] and filtered 5 list_issues results down to an empty visible list ([DIFC-FILTERED] entries logged with clear reasons: "lower integrity than agent requires"). This is expected over-filtering by design (only approved-integrity issues are visible) and confirms the guard pipeline is active and working correctly.
• Daily AgentRx Trace Optimizer (35822805196): failure, but agent_execution.json shows state: "not_started" — the agent job itself never launched (no mcp-logs/ artifacts were produced at all). This is an activation-level infrastructure issue, not a DIFC concern; classified 🟢 Info per audit guidance. No repeated rate-limit signature was found in this run's logs to recommend cron staggering, but worth a follow-up check if it recurs.
• PR Sous Chef (35823608396): success. DIFC/guard pipeline showed no filtered events in this run's rpc-messages.jsonl (only safeoutputs writes: resolve_pull_request_review_thread, one status-report body). No scope violations.

Runs Analyzed

Run	Workflow	Branch	Agent Invoked	DIFC Events	Firewall Blocks	Status
35823623920	Daily VulnHunter Scan	main	✅	guard init + label_agent logged, 0 filtered	1/65 (anthropic retry)	✅
35822805196	Daily AgentRx Trace Optimizer	main	❌ not_started (activation)	0 (no mcp-logs)	n/a	🟢 (infra, not DIFC)
35822724588	GitHub Remote MCP Authentication Test	main	✅	5 DIFC-FILTERED (expected)	1/13 (ab.chatgpt.com denied)	⚠️ (separate canary job hit 429, unrelated to gateway)
35823608396	PR Sous Chef	main	✅	0 filtered (safeoutputs writes only)	2/33 (github.com git denied)	✅

Recommendations

1. PR Sous Chef / git remote configuration: Investigate whether the pr-sous-chef workflow (or its shared pr-finisher skill) needs to reconfigure the git remote to use the sandboxed proxy before running git checkout/git fetch against branches from origin. This workflow does use tools.github for API access already (confirmed via github.log), so the fix is specific to raw git operations, not MCP tool calls. Add a note to the workflow prompt or setup step instructing the agent to avoid git fetch/checkout against the public https://github.com/... remote directly.
2. ab.chatgpt.com background call: Low priority — track whether this recurs in future GitHub Remote MCP Authentication Test runs; if so, identify the tool/dependency responsible (likely an OpenAI/Codex SDK telemetry beacon) and either allowlist it explicitly (if benign and non-data-bearing) or suppress it via environment variable if the SDK supports opting out of analytics.
3. Daily AgentRx Trace Optimizer: Currently a single not_started failure in the sampled window; not enough evidence to recommend cron staggering yet. Recommend monitoring for repeated not_started/rate-limit patterns over the next few days before escalating.
4. General: DIFC labeling, FORCED REPOS=PUBLIC override, and [DIFC-FILTERED] reasoning all appear correctly scoped (e.g., issue:github/gh-aw#62879 rather than a bare approved tag) — no unscoped-tag anomalies found in this sample. Continue routine sampling; consider widening future audits to cover more of the ~17 daily/scheduled workflows not yet inspected in this pass.

See shared/mcp-api-routing.md for reusable constraint language already embedded in workflow prompts to keep agents on the MCP Gateway path.

Generated by Integrity Filtering Audit · copilot · auto · 197.9 AIC · ⊞ 13.2K · ◷

• expires on Sep 30, 2026, 6:04 AM UTC