Fix agentic-workflows MCP server mount configuration

[github-actions]

Problem

The daily observability report workflow (discussion #11911) failed because the agentic_workflows MCP server couldn't execute status and logs tools. Investigation revealed a mount configuration mismatch.

Root Cause

The TOML configuration for the agentic_workflows MCP server (used by Codex engine) was missing critical mounts:

Before (TOML - Codex):

mounts = ["/opt/gh-aw:/opt/gh-aw:ro"]

Expected (JSON - Other engines):

"mounts": [
  "/opt/gh-aw:/opt/gh-aw:ro",
  "${{github.workspace}}:${{github.workspace}}:rw", 
  "/tmp/gh-aw:/tmp/gh-aw:rw"
]

Impact

Without the missing mounts, MCP tools failed because:

• ❌ No workspace access - status and compile tools couldn't read workflow files
• ❌ No write access - logs and audit tools couldn't save output files to /tmp/gh-aw
• ❌ Complete workflow failure - Daily observability report couldn't collect any data

Solution

Updated pkg/workflow/mcp_renderer.go to include all three mounts in the TOML configuration:

yaml.WriteString("          mounts = [\"" + constants.DefaultGhAwMount + 
    "\", \"" + constants.DefaultWorkspaceMount + 
    "\", \"" + constants.DefaultTmpGhAwMount + "\"]\n")

This aligns TOML configuration (Codex) with JSON configuration (Claude/Copilot/Custom engines).

Verification

• ✅ Uses existing constants from pkg/constants/constants.go
• ✅ Only 1 workflow affected: daily-observability-report.md (Codex engine)
• ✅ No test updates required (tests don't check specific mount arrays)
• ✅ Surgical change - only adds missing mounts to match other engines

Testing

After merge, the daily observability report should successfully:

1. Execute status tool to list workflows
2. Execute logs tool to download run logs to /tmp/gh-aw/aw-mcp/logs/
3. Execute audit tool to analyze specific runs
4. Generate comprehensive observability coverage report

References

• Fixes #11911
• Investigation logs from run #21365362417
• MCP Gateway Specification v1.0.0 (containerized stdio servers)

AI generated by Q

---

Note

This was originally intended as a pull request, but the git push operation failed.

Workflow Run: View run details and download patch artifact

The patch file is available in the agent-artifacts artifact in the workflow run linked above.

To apply the patch locally:

# Download the artifact from the workflow run https://github.com/githubnext/gh-aw/actions/runs/21426410017
# (Use GitHub MCP tools if gh CLI is not available)
gh run download 21426410017 -n agent-artifacts

# The patch file will be at agent-artifacts/tmp/gh-aw/aw.patch after download
# Apply the patch
git am agent-artifacts/tmp/gh-aw/aw.patch

Show patch preview (49 of 49 lines)

From 76913025d78528bd618489c6d9724032cdc2b472 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Wed, 28 Jan 2026 05:41:03 +0000
Subject: [PATCH] fix: add missing mounts for agentic-workflows MCP server in
 TOML config

The agentic_workflows MCP server configuration in TOML format (used by
Codex engine) was missing critical mounts that prevented MCP tools from
functioning properly.

**Root Cause:**
- TOML config only had: /opt/gh-aw:/opt/gh-aw:ro
- JSON config (other engines) had all three mounts
- This caused MCP tools (status, logs, audit) to fail

**Impact:**
- Tools couldn't access workspace files (status, compile)
- Tools couldn't write output files (logs, audit)
- Daily observability report workflow completely failed

**Fix:**
Add workspace and /tmp/gh-aw mounts to TOML config to match JSON:
- /opt/gh-aw:/opt/gh-aw:ro (binary, read-only)
- ${{github.workspace}}:${{github.workspace}}:rw (workspace access)
- /tmp/gh-aw:/tmp/gh-aw:rw (logs/output files)

Fixes #11911
---
 pkg/workflow/mcp_renderer.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkg/workflow/mcp_renderer.go b/pkg/workflow/mcp_renderer.go
index 4dadc0a..a4657f5 100644
--- a/pkg/workflow/mcp_renderer.go
+++ b/pkg/workflow/mcp_renderer.go
@@ -338,7 +338,8 @@ func (r *MCPConfigRendererUnified) renderAgenticWorkflowsTOML(yaml *strings.Buil
 	yaml.WriteString("          container = \"" + constants.DefaultAlpineImage + "\"\n")
 	yaml.WriteString("          entrypoint = \"/opt/gh-aw/gh-aw\"\n")
 	yaml.WriteString("          entrypointArgs = [\"mcp-server\"]\n")
-	yaml.WriteString("          mounts = [\"" + constants.DefaultGhAwMount + "\"]\n")
+	// Mount gh-aw binary (read-only), workspace (read-write for status/compile), and temp directory (read-write for logs)
+	yaml.WriteString("          mounts = [\"" + constants.DefaultGhAwMount + "\", \"" + constants.DefaultWorkspaceMount + "\", \"" + constants.DefaultTmpGhAwMount + "\"]
... (truncated)