Remove the GitHub MCP server; make gh CLI the canonical GitHub surface #275

Problem

The devbox gives agents two GitHub surfaces: the gh CLI and the pinned local
GitHub MCP server (github/github-mcp-server v1.12.2) behind the
response-bounding proxy. The MCP server cannot read or write GitHub issue
dependencies ("Blocked by" / "blocking" relationships), which this repository
relies on for triage and planning:

• The AGENTS.md triage vocabulary selects issues with "no open 'Blocked by'
  links", and the Lima plan of record (Bootstrap a minimal Fedora Lima VM as the devbox development environment #267–Retire the container-based devbox #274) is dependency-wired.
• The MCP's 43-tool catalog supports sub-issue hierarchy (issue_read
  sub-issue methods, sub_issue_write) but has no dependency tools at all
  — neither read nor write.

Verified 2026-09-28:

• MCP issue_read on Preserve complete command output when results are compacted #125 returns its labels (blocked, value:high,
  confidence:medium) but no relationship data; gh issue view 125 --json blockedBy,blocking returns the actual blocked-by link (Trial headroom as a recoverable tool-output compressor (tokenjuice successor) #131).
• The gap is actively misleading in this repo because of the dual
  conventions: the blocked label means a non-issue blocker while
  "Blocked by" links are issue dependencies. The MCP shows the label and
  hides the link, so an agent cannot distinguish the two. The search path
  compounds it: is:blocked matched exactly the label-blocked open issues
  here (ambiguous with the legacy label), while has:blocked-by is the
  precise dependency qualifier (returns exactly the 8 open issues carrying
  dependency links: Benchmark and validate host-to-VM directory sharing (9p vs virtiofs) using nested VMs #268–Retire the container-based devbox #274 and Preserve complete command output when results are compacted #125).
• Upstream outlook: v1.12.2 (2026-09-16) is the latest release; the
  dependency feature requests (Add ability to fetch issue relationships (parent, blocked by, etc..) github/github-mcp-server#950,
  Add issue dependency tools for blocked-by relationships github/github-mcp-server#1927, Add addBlockedBy / removeBlockedBy mutations (native issue dependencies) to MCP server github/github-mcp-server#2391) were closed
  and the implementing community PR (Add issue dependency support (blocked by/blocking relationships) - Fixes #950 github/github-mcp-server#1939) was
  closed unmerged. Nothing is shipping upstream.
• The image's gh CLI 2.97.0 has full GA dependency support:
  • read: gh issue view <n> --json blockedBy,blocking; gh api repos/<o>/<r>/issues returns issue_dependencies_summary.total_blocked_by
    per item, so dependency-aware enumeration stays a single call
  • write: gh issue create --blocked-by/--blocking, gh issue edit --add-blocked-by/--remove-blocking
  • search: gh search issues 'has:blocked-by' (not is:blocked)

Decision (John, 2026-09-28): remove the GitHub MCP server and make gh the
canonical GitHub surface.

Proposed improvement

1. Remove the integration

• devbox launcher (~lines 610–641): drop the mcp.servers.github config
  fragment. Keep the GH_TOKEN/GITHUB_TOKEN passthrough and
  gh auth setup-git — the gh CLI still needs them.
• container/github_mcp_server_proxy.py: delete, along with its Dockerfile
  install block (~lines 419–422).
• container/tool-versions.json: remove the github_mcp_server entry
  (version, checksums, provenance); remove the Dockerfile install block
  (~lines 133–141).
• Tests: delete tests/unit/test_github_mcp_server_proxy.py; rework the
  GitHub-MCP parts of tests/unit/test_devbox_params.py,
  tests/container/test_opencode_config.py (the config-shape test and the
  "GitHub search" guidance needles), and tests/container/test_image_binaries.py.

2. Rework agent guidance gh-first

• container/agent-skills/devbox-tools/SKILL.md "GitHub search" entry:
  gh-first rewrite. The proxy enforced output bounds structurally (forced
  field projection, perPage <= 20, 64 KiB result cap — issue Bound GitHub search responses and honor requested fields #187); that
  discipline must now live in the guidance and be pinned by tests:
  • Always pass an explicit --json field list (gh issue/gh pr/
    gh search) or a --jq projection (gh api); never print full API
    objects.
  • Enumerate with bounded pages (--limit, small per_page=) instead of
    unbounded --paginate unless paired with a projection.
  • Do not fetch bodies/comments during enumeration; read them with a
    targeted gh issue view <n> after shortlisting.
  • Keep dependency-aware selection in one call: gh api 'repos/<o>/<r>/issues?state=open&per_page=…' returns labels, assignees,
    and issue_dependencies_summary per item.
  • Document the dependency operations: gh issue view --json blockedBy,blocking, gh issue edit --add-blocked-by/--remove-blocking,
    gh search issues 'has:blocked-by' — and warn that is:blocked is
    ambiguous in this repo because of the legacy blocked label.
• .agents/skills/issue-to-pr/SKILL.md: remove the "or the GitHub MCP
  server" routing clauses (intro and Guardrails) and the list_issues aside
  in step 1; the gh api enumeration is already the primary path.
• README.md: update the credential-passthrough bullet (~line 62) and the
  GitHub-MCP-proxy paragraph (~line 360).
• Context win: removal drops 43 MCP tool definitions plus the server's
  instructions from every session.

3. Continuity

• Existing containers need devbox --recreate (generated config and image
  contents change; the launcher self-hash/fingerprint reports staleness).
• Port the OpenCode runtime integration and do-one-issue to the VM #272 (port the OpenCode runtime integration to the Lima VM) must not carry
  the GitHub MCP forward — gh is the canonical surface there too.

Acceptance criteria

• After devbox --recreate, a fresh OpenCode session has no github MCP
  server configured (asserted by the container config test), and
  github-mcp-server/github-mcp-server-proxy are absent from the image
  (asserted by the image binary test).
• container/tool-versions.json contains no github_mcp_server entry;
  tool-version validation and provenance verification pass.
• No repo guidance references the GitHub MCP: the devbox-tools skill, the
  issue-to-pr skill, and the README are gh-first, including the
  output-bounding discipline and the dependency read/write/search commands
  above.
• Needle/behavioral tests pin the new gh-first guidance, replacing the
  current MCP guidance needles.
• Full CI passes (CI Workflow - Success); Mergify lands the PR.