Remove built-in GitHub and Jira issue tools#586
Merged
Conversation
Co-authored-by: Nick Misasi <nick13misasi@gmail.com>
Co-authored-by: Nick Misasi <nick13misasi@gmail.com>
🤖 LLM Evaluation ResultsOpenAI✅ Overall: 19/19 tests passed (100.0%)
Anthropic
❌ Failed EvaluationsShow 1 failuresANTHROPIC1. TestReactEval/[anthropic]_react_cat_message
This comment was automatically generated by the eval CI pipeline. |
📝 WalkthroughWalkthroughThe changes remove GitHub and Jira integration tools from the system, including their implementations, dependencies, and documentation. These integrations are being replaced with MCP servers and other configured integrations. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
conversations/conversations_test.go (1)
37-40: Usemmtools.SearchServerArgsin the mock schema to prevent drift.Line 39 duplicates the tool input shape with an anonymous struct. If
mmtools.SearchServerArgschanges (fields/tags), this test can silently diverge from production behavior.♻️ Proposed refactor
import ( "bytes" "io" "net/http" "path/filepath" "testing" "github.com/mattermost/mattermost-plugin-ai/bots" "github.com/mattermost/mattermost-plugin-ai/conversations" "github.com/mattermost/mattermost-plugin-ai/enterprise" "github.com/mattermost/mattermost-plugin-ai/evals" "github.com/mattermost/mattermost-plugin-ai/i18n" "github.com/mattermost/mattermost-plugin-ai/llm" "github.com/mattermost/mattermost-plugin-ai/llmcontext" "github.com/mattermost/mattermost-plugin-ai/mcp" + "github.com/mattermost/mattermost-plugin-ai/mmtools" "github.com/mattermost/mattermost-plugin-ai/mmapi/mocks" "github.com/mattermost/mattermost-plugin-ai/prompts" @@ tools = append(tools, llm.Tool{ Name: "SearchServer", Description: "Search the Mattermost chat server for relevant messages.", - Schema: llm.NewJSONSchemaFromStruct[struct{ Term string }](), + Schema: llm.NewJSONSchemaFromStruct[mmtools.SearchServerArgs](), Resolver: func(context *llm.Context, args llm.ToolArgumentGetter) (string, error) { return "No relevant messages found.", nil }, })🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@conversations/conversations_test.go` around lines 37 - 40, The test is using an anonymous struct for the tool schema (llm.NewJSONSchemaFromStruct[struct{ Term string }]()) which can drift from the real input type; replace the anonymous type with the canonical mmtools.SearchServerArgs type in the schema call so the mock always matches production (update imports if needed and keep the Resolver signature intact), i.e., change llm.NewJSONSchemaFromStruct[...] to use mmtools.SearchServerArgs so the tool "SearchServer" test schema stays in sync.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@conversations/conversations_test.go`:
- Around line 37-40: The test is using an anonymous struct for the tool schema
(llm.NewJSONSchemaFromStruct[struct{ Term string }]()) which can drift from the
real input type; replace the anonymous type with the canonical
mmtools.SearchServerArgs type in the schema call so the mock always matches
production (update imports if needed and keep the Resolver signature intact),
i.e., change llm.NewJSONSchemaFromStruct[...] to use mmtools.SearchServerArgs so
the tool "SearchServer" test schema stays in sync.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 9aa3e208-c853-40b9-a233-e0338dd36eef
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (11)
NOTICE.txtconversations/conversations_test.godocs/admin_guide.mddocs/sovereign_ai.mddocs/user_guide.mdgo.modmmtools/github.gommtools/jira.gommtools/provider.gommtools/provider_test.goserver/main.go
💤 Files with no reviewable changes (7)
- docs/user_guide.md
- docs/admin_guide.md
- server/main.go
- NOTICE.txt
- mmtools/github.go
- go.mod
- mmtools/jira.go
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Security Review: No findings
This PR strictly removes the built-in GitHub and Jira issue tools, their dependencies, and associated documentation. No new code, endpoints, data flows, or user inputs are introduced.
The change is a net security improvement:
- Reduced attack surface: Two tool implementations and their third-party dependencies (
go-jira,go-github) are removed. - SSRF vector removed: The deleted Jira tool accepted an LLM-controlled
instanceURLpassed tojira.NewClient, which was an SSRF-susceptible pattern. This risk no longer exists. - Fewer dependencies: Removing
andygrunwald/go-jira,google/go-github/v41, and transitive dependencies (fatih/structs,trivago/tgo,golang-jwt/v4,go-querystring) reduces supply-chain risk.
Sent by Cursor Automation: Find vulnerabilities
crspeller
requested changes
Apr 1, 2026
| Name: "GetGithubIssue", | ||
| Description: "Retrieve a single GitHub issue by owner, repo, and issue number.", | ||
| Schema: llm.NewJSONSchemaFromStruct[mmtools.GetGithubIssueArgs](), | ||
| Name: "SearchServer", |
Member
There was a problem hiding this comment.
Uh.... what? A search tool that does nothing. Very useful.
Collaborator
Author
There was a problem hiding this comment.
This is the mockToolProvider implementation - it didn't do anything previously either
crspeller
approved these changes
Apr 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes the built-in
GetGithubIssueandGetJiraIssuetools, deletes their provider wiring and implementation code, updates related docs to stop advertising those built-in integrations, and removes the now-unused Go dependencies and staleNOTICE.txtentries.Ticket Link
NONE
Screenshots
NONE
Release Note
Summary by CodeRabbit
Removed Features
Documentation