[kayahk]

Summary

Add an issue_list MCP tool and a repository-scoped, git:read-guarded API path for providers that declare optional issue listing. The existing issue_get tool continues to retrieve a single issue.

Provider text is fenced as untrusted; pagination, provider errors, repository scope and audit behavior follow existing Git operations.

Dependencies

• SDK contract: feat(gitprovider): add optional issue listing plugin-sdk-go#15
• GitHub provider tracking: Expose tools to read and list repository issues paca-plugin-github#32

A provider implementing the optional operation is required for live use. The SPI files are generated from the companion SDK change.

Validation

• go test ./... in services/api (environment-gated integration tests follow their existing skip behavior)
• npm test in apps/mcp: 735 passed
• npm run build; Biome checks for touched TypeScript files

[pullfrog]

ℹ️ One minor doc-count inconsistency, nothing blocking. Code, authorization and fencing all check out.

Reviewed changes

Adds repository issue listing end to end — an issue_list MCP tool, a git:read-gated core route, and an optional IssueList provider capability.

• New issue_list MCP tool — added to GIT_TOOL_NAMES and handleGitTool, forwarding state and cursor to GET …/issues and fencing the page with fenceFields; schema restricts state to open/closed/all.
• Fencing refactor — UNTRUSTED_KEYS gains labels, and fenceFields now fences array-of-strings under an untrusted key (and bare top-level strings) by passing the key through arrays. Verified behavior-preserving for every other shape, with no unfenced or double-fenced case.
• Core service path — Service.ListIssues validates state, checks project ownership via resolve, gates on the IssueList capability before the optional-interface assertion, and audits as issue.list. Handler and route mirror the sibling reads.
• SPI wire types — generated ListIssuesRequest/IssuePage, the issue_list capability, client_ops.go and the golden were regenerated from the companion SDK change.

ℹ️ Git category tool count not bumped in the docs

The PR adds issue_list to the Git section of both tool docs and updates the bullet, but the section headings still read "(27 tools)" while the section now lists 28. The headings were accurate before this change (20 git tools + 4 workspace + 3 repo = 27), so they are now off by one.

Technical details

# Git category count is stale after adding issue_list

## Affected sites
- apps/mcp/README.md:353 — `### 🔗 Git (27 tools)`; the section now contains 28 tools
- apps/mcp/ALL_TOOLS.md:101 — `### 14. Git (27 tools)`; same list, same count

## Required outcome
- Both headings read 28, reflecting `issue_list` added at README.md:364 / ALL_TOOLS.md:113.

## Notes
- The running `Total Tools: 81` figures (README.md:259, ALL_TOOLS.md:139, docs/guides/mcp-server-setup.md:152)
  were already inconsistent with the detailed lists before this PR, so they are not
  called out here. If those totals are meant to be maintained, they need a separate sweep.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pikann]

LGTM! Thank you so much for your contribution.

I'll continue working on the web app and the GitLab plugin for the git issue linking feature