Context
Hit twice tonight (2026-06-12 ~03:05Z) while executing the pull-request §6.2 invitation layer on PR #12948: the manage_pr_reviewers MCP tool failed, and the underlying cause also breaks direct gh pr edit (used for PR-body edits).
Release classification: boardless — tooling friction; the validation layer (cross-family review itself) is unaffected.
The Problem
The tool shells out to gh pr edit <n> --add-reviewer <login>, which resolves logins via GraphQL. On a token without the read:org scope, GitHub rejects the query:
GraphQL: Your token has not been granted the required scopes... The 'login' field requires ['read:org'],
but your token has only been granted: ['notifications', 'project', 'repo', 'user', 'workflow', 'write:discussion']
The active agent-token shape (above) is exactly that — so the documented §6.2 step (manage_pr_reviewers({action: 'add', ...}) after CI-green) fails for every agent on this credential class. The same wall hits gh pr edit --body (PR-body fixes after lint failures — e.g. tonight's invisible-anchor repair on PR #12948).
Working fallback (verified tonight, both directions):
gh api repos/neomjs/neo/pulls/<n>/requested_reviewers -X POST -f 'reviewers[]=<login>' # add reviewer — succeeded
gh api repos/neomjs/neo/pulls/<n> -X PATCH -F body=@<file> # body edit — succeeded
The REST endpoints need only repo scope.
The Architectural Reality
ai/mcp/server/github-workflow/ owns the tool; its handler wraps the gh pr edit CLI (the tool description says so explicitly). The MCP error surface tonight returned the raw GraphQL scope error with HTTP-equivalent failure — no retry path, no hint at the REST alternative.
The Fix
Reroute the manage_pr_reviewers handler from gh pr edit --add-reviewer/--remove-reviewer to the REST requested_reviewers endpoint (POST/DELETE /repos/{owner}/{repo}/pulls/{n}/requested_reviewers), which matches the tool's add/remove contract 1:1 and drops the GraphQL scope requirement. Alternatively (lesser): keep CLI primary and add REST fallback on scope-error detection — but the unconditional REST route is simpler and strictly less privileged.
Acceptance Criteria
Out of Scope
- PR-body editing tooling (no MCP tool exists for it today; agents use
gh api directly — documenting that in the pull-request skill is a possible doc follow-up, not this ticket).
Related
#10217 (created the tool surface) · pull-request workflow §6.2 (the invitation layer this breaks) · Empirical anchors: PR #12948 reviewer-add failure + body-edit failure, both recovered via REST (this session).
Live latest-open sweep: checked latest 20 open issues at 2026-06-12T03:11Z; no equivalent (closed #10217 is the tool's creation; #11467 is timing policy). A2A in-flight sweep: clean.
Origin Session ID: c29b5ccc-d711-4cde-8401-32d1e4bbc4f1
Retrieval Hint: "manage_pr_reviewers read:org scope GraphQL failure REST requested_reviewers fallback"
Context
Hit twice tonight (2026-06-12 ~03:05Z) while executing the
pull-request§6.2 invitation layer on PR#12948: themanage_pr_reviewersMCP tool failed, and the underlying cause also breaks directgh pr edit(used for PR-body edits).Release classification:boardless — tooling friction; the validation layer (cross-family review itself) is unaffected.The Problem
The tool shells out to
gh pr edit <n> --add-reviewer <login>, which resolves logins via GraphQL. On a token without theread:orgscope, GitHub rejects the query:The active agent-token shape (above) is exactly that — so the documented §6.2 step (
manage_pr_reviewers({action: 'add', ...})after CI-green) fails for every agent on this credential class. The same wall hitsgh pr edit --body(PR-body fixes after lint failures — e.g. tonight's invisible-anchor repair on PR#12948).Working fallback (verified tonight, both directions):
The REST endpoints need only
reposcope.The Architectural Reality
ai/mcp/server/github-workflow/owns the tool; its handler wraps thegh pr editCLI (the tool description says so explicitly). The MCP error surface tonight returned the raw GraphQL scope error with HTTP-equivalent failure — no retry path, no hint at the REST alternative.The Fix
Reroute the
manage_pr_reviewershandler fromgh pr edit --add-reviewer/--remove-reviewerto the RESTrequested_reviewersendpoint (POST/DELETE /repos/{owner}/{repo}/pulls/{n}/requested_reviewers), which matches the tool's add/remove contract 1:1 and drops the GraphQL scope requirement. Alternatively (lesser): keep CLI primary and add REST fallback on scope-error detection — but the unconditional REST route is simpler and strictly less privileged.Acceptance Criteria
manage_pr_reviewersadd/remove succeeds on a token with only the scope set listed above (verified against a live PR).Out of Scope
gh apidirectly — documenting that in the pull-request skill is a possible doc follow-up, not this ticket).Related
#10217(created the tool surface) · pull-request workflow §6.2 (the invitation layer this breaks) · Empirical anchors: PR#12948reviewer-add failure + body-edit failure, both recovered via REST (this session).Live latest-open sweep: checked latest 20 open issues at 2026-06-12T03:11Z; no equivalent (closed
#10217is the tool's creation;#11467is timing policy). A2A in-flight sweep: clean.Origin Session ID: c29b5ccc-d711-4cde-8401-32d1e4bbc4f1
Retrieval Hint: "manage_pr_reviewers read:org scope GraphQL failure REST requested_reviewers fallback"