Add basic html sanitization

Author: JoannaaKL

pkg/github/issues.go

@@ -212,15 +212,15 @@ func fragmentToIssue(fragment IssueFragment) *github.Issue {
 
 	return &github.Issue{
 		Number:    github.Ptr(int(fragment.Number)),
-		Title:     github.Ptr(sanitize.FilterInvisibleCharacters(string(fragment.Title))),
+		Title:     github.Ptr(sanitize.Sanitize(string(fragment.Title))),
 		CreatedAt: &github.Timestamp{Time: fragment.CreatedAt.Time},
 		UpdatedAt: &github.Timestamp{Time: fragment.UpdatedAt.Time},
 		User: &github.User{
 			Login: github.Ptr(string(fragment.Author.Login)),
 		},
 		State:    github.Ptr(string(fragment.State)),
 		ID:       github.Ptr(fragment.DatabaseID),
-		Body:     github.Ptr(sanitize.FilterInvisibleCharacters(string(fragment.Body))),
+		Body:     github.Ptr(sanitize.Sanitize(string(fragment.Body))),
 		Labels:   foundLabels,
 		Comments: github.Ptr(int(fragment.Comments.TotalCount)),
 	}
@@ -327,10 +327,10 @@ func GetIssue(ctx context.Context, client *github.Client, owner string, repo str
 	// Sanitize title/body on response
 	if issue != nil {
 		if issue.Title != nil {
-			issue.Title = github.Ptr(sanitize.FilterInvisibleCharacters(*issue.Title))
+			issue.Title = github.Ptr(sanitize.Sanitize(*issue.Title))
 		}
 		if issue.Body != nil {
-			issue.Body = github.Ptr(sanitize.FilterInvisibleCharacters(*issue.Body))
+			issue.Body = github.Ptr(sanitize.Sanitize(*issue.Body))
 		}
 	}
 

pkg/github/pullrequests.go

@@ -127,10 +127,10 @@ func GetPullRequest(ctx context.Context, client *github.Client, owner, repo stri
 	// sanitize title/body on response
 	if pr != nil {
 		if pr.Title != nil {
-			pr.Title = github.Ptr(sanitize.FilterInvisibleCharacters(*pr.Title))
+			pr.Title = github.Ptr(sanitize.Sanitize(*pr.Title))
 		}
 		if pr.Body != nil {
-			pr.Body = github.Ptr(sanitize.FilterInvisibleCharacters(*pr.Body))
+			pr.Body = github.Ptr(sanitize.Sanitize(*pr.Body))
 		}
 	}
 
@@ -821,10 +821,10 @@ func ListPullRequests(getClient GetClientFn, t translations.TranslationHelperFun
 					continue
 				}
 				if pr.Title != nil {
-					pr.Title = github.Ptr(sanitize.FilterInvisibleCharacters(*pr.Title))
+					pr.Title = github.Ptr(sanitize.Sanitize(*pr.Title))
 				}
 				if pr.Body != nil {
-					pr.Body = github.Ptr(sanitize.FilterInvisibleCharacters(*pr.Body))
+					pr.Body = github.Ptr(sanitize.Sanitize(*pr.Body))
 				}
 			}
 

pkg/sanitize/sanitize.go

@@ -4,20 +4,10 @@ import (
 	"github.com/microcosm-cc/bluemonday"
 )
 
-type ContentFilter struct {
-	HTMLPolicy *bluemonday.Policy
-}
-
-func NewContentFilter() *ContentFilter {
-	p := bluemonday.NewPolicy()
-	p.AllowElements("b", "blockquote", "br", "code", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul")
-	p.AllowAttrs("img", "a")
-	p.AllowAttrs()
-	p.AllowURLSchemes("https")
+var policy *bluemonday.Policy
 
-	return &ContentFilter{
-		HTMLPolicy: p,
-	}
+func Sanitize(input string) string {
+	return FilterHTMLTags(FilterInvisibleCharacters(input))
 }
 
 // FilterInvisibleCharacters removes invisible or control characters that should not appear
@@ -40,11 +30,25 @@ func FilterInvisibleCharacters(input string) string {
 	return string(out)
 }
 
-func (cf *ContentFilter) FilterHtmlTags(input string) string {
+func FilterHTMLTags(input string) string {
+	if policy == nil {
+		policyInit()
+	}
 	if input == "" {
 		return input
 	}
-	return cf.HTMLPolicy.Sanitize(input)
+	return policy.Sanitize(input)
+}
+
+func policyInit() {
+	if policy != nil {
+		return
+	}
+	policy = bluemonday.StrictPolicy()
+	policy.AllowElements("b", "blockquote", "br", "code", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul")
+	policy.AllowAttrs("img", "a")
+	policy.AllowURLSchemes("https")
+	policy.AllowImages()
 }
 
 func shouldRemoveRune(r rune) bool {

pkg/sanitize/sanitize_test.go

@@ -186,3 +186,64 @@ func TestShouldRemoveRune(t *testing.T) {
 		})
 	}
 }
+
+func TestFilterHtmlTags(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "empty string",
+			input:    "",
+			expected: "",
+		},
+		{
+			name:     "allowed simple tags preserved",
+			input:    "<b>bold</b>",
+			expected: "<b>bold</b>",
+		},
+		{
+			name:     "multiple allowed tags",
+			input:    "<b>bold</b> and <em>italic</em>",
+			expected: "<b>bold</b> and <em>italic</em>",
+		},
+		{
+			name:     "code tag preserved",
+			input:    "<code>fmt.Println(\"hi\")</code>",
+			expected: "<code>fmt.Println(&#34;hi&#34;)</code>", // quotes are escaped by sanitizer
+		},
+		{
+			name:     "disallowed script removed entirely",
+			input:    "<script>alert(1)</script>",
+			expected: "", // StrictPolicy should drop script element and contents
+		},
+		{
+			name:     "anchor removed but inner text kept",
+			input:    "Click <a href='https://example.com'>here</a> now",
+			expected: "Click here now",
+		},
+		{
+			name:     "image removed (no textual fallback)",
+			input:    "<img src='x' alt='y'>",
+			expected: "<img src=\"x\" alt=\"y\">", // images are allowed via AllowImages()
+		},
+		{
+			name:     "mixed allowed and disallowed",
+			input:    "<b>bold</b> <script>alert(1)</script> <em>italic</em>",
+			expected: "<b>bold</b>  <em>italic</em>",
+		},
+		{
+			name:     "idempotent sanitization",
+			input:    FilterHTMLTags("<b>bold</b> and <em>italic</em>"),
+			expected: "<b>bold</b> and <em>italic</em>",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := FilterHTMLTags(tt.input)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}

third-party-licenses.darwin.md

@@ -7,44 +7,48 @@ The following open source dependencies are used to build the [github/github-mcp-
 Some packages may only be included on certain architectures or operating systems.
 
 
- - [github.com/bahlo/generic-list-go](https://pkg.go.dev/github.com/bahlo/generic-list-go) ([BSD-3-Clause](https://github.com/bahlo/generic-list-go/blob/v0.2.0/LICENSE))
- - [github.com/buger/jsonparser](https://pkg.go.dev/github.com/buger/jsonparser) ([MIT](https://github.com/buger/jsonparser/blob/v1.1.1/LICENSE))
- - [github.com/fsnotify/fsnotify](https://pkg.go.dev/github.com/fsnotify/fsnotify) ([BSD-3-Clause](https://github.com/fsnotify/fsnotify/blob/v1.9.0/LICENSE))
+ - [github.com/aymerick/douceur](https://pkg.go.dev/github.com/aymerick/douceur) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/aymerick/douceur/LICENSE))
+ - [github.com/bahlo/generic-list-go](https://pkg.go.dev/github.com/bahlo/generic-list-go) ([BSD-3-Clause](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/bahlo/generic-list-go/LICENSE))
+ - [github.com/buger/jsonparser](https://pkg.go.dev/github.com/buger/jsonparser) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/buger/jsonparser/LICENSE))
+ - [github.com/fsnotify/fsnotify](https://pkg.go.dev/github.com/fsnotify/fsnotify) ([BSD-3-Clause](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/fsnotify/fsnotify/LICENSE))
  - [github.com/github/github-mcp-server](https://pkg.go.dev/github.com/github/github-mcp-server) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/LICENSE))
- - [github.com/go-openapi/jsonpointer](https://pkg.go.dev/github.com/go-openapi/jsonpointer) ([Apache-2.0](https://github.com/go-openapi/jsonpointer/blob/v0.19.5/LICENSE))
- - [github.com/go-openapi/swag](https://pkg.go.dev/github.com/go-openapi/swag) ([Apache-2.0](https://github.com/go-openapi/swag/blob/v0.21.1/LICENSE))
- - [github.com/go-viper/mapstructure/v2](https://pkg.go.dev/github.com/go-viper/mapstructure/v2) ([MIT](https://github.com/go-viper/mapstructure/blob/v2.4.0/LICENSE))
- - [github.com/google/go-github/v71/github](https://pkg.go.dev/github.com/google/go-github/v71/github) ([BSD-3-Clause](https://github.com/google/go-github/blob/v71.0.0/LICENSE))
- - [github.com/google/go-github/v76/github](https://pkg.go.dev/github.com/google/go-github/v76/github) ([BSD-3-Clause](https://github.com/google/go-github/blob/v76.0.0/LICENSE))
- - [github.com/google/go-querystring/query](https://pkg.go.dev/github.com/google/go-querystring/query) ([BSD-3-Clause](https://github.com/google/go-querystring/blob/v1.1.0/LICENSE))
- - [github.com/google/uuid](https://pkg.go.dev/github.com/google/uuid) ([BSD-3-Clause](https://github.com/google/uuid/blob/v1.6.0/LICENSE))
- - [github.com/gorilla/mux](https://pkg.go.dev/github.com/gorilla/mux) ([BSD-3-Clause](https://github.com/gorilla/mux/blob/v1.8.0/LICENSE))
- - [github.com/invopop/jsonschema](https://pkg.go.dev/github.com/invopop/jsonschema) ([MIT](https://github.com/invopop/jsonschema/blob/v0.13.0/COPYING))
- - [github.com/josephburnett/jd/v2](https://pkg.go.dev/github.com/josephburnett/jd/v2) ([MIT](https://github.com/josephburnett/jd/blob/v1.9.2/LICENSE))
- - [github.com/josharian/intern](https://pkg.go.dev/github.com/josharian/intern) ([MIT](https://github.com/josharian/intern/blob/v1.0.0/license.md))
- - [github.com/mailru/easyjson](https://pkg.go.dev/github.com/mailru/easyjson) ([MIT](https://github.com/mailru/easyjson/blob/v0.7.7/LICENSE))
- - [github.com/mark3labs/mcp-go](https://pkg.go.dev/github.com/mark3labs/mcp-go) ([MIT](https://github.com/mark3labs/mcp-go/blob/v0.36.0/LICENSE))
- - [github.com/migueleliasweb/go-github-mock/src/mock](https://pkg.go.dev/github.com/migueleliasweb/go-github-mock/src/mock) ([MIT](https://github.com/migueleliasweb/go-github-mock/blob/v1.3.0/LICENSE))
- - [github.com/pelletier/go-toml/v2](https://pkg.go.dev/github.com/pelletier/go-toml/v2) ([MIT](https://github.com/pelletier/go-toml/blob/v2.2.4/LICENSE))
- - [github.com/sagikazarmark/locafero](https://pkg.go.dev/github.com/sagikazarmark/locafero) ([MIT](https://github.com/sagikazarmark/locafero/blob/v0.11.0/LICENSE))
- - [github.com/shurcooL/githubv4](https://pkg.go.dev/github.com/shurcooL/githubv4) ([MIT](https://github.com/shurcooL/githubv4/blob/48295856cce7/LICENSE))
- - [github.com/shurcooL/graphql](https://pkg.go.dev/github.com/shurcooL/graphql) ([MIT](https://github.com/shurcooL/graphql/blob/ed46e5a46466/LICENSE))
- - [github.com/sourcegraph/conc](https://pkg.go.dev/github.com/sourcegraph/conc) ([MIT](https://github.com/sourcegraph/conc/blob/5f936abd7ae8/LICENSE))
- - [github.com/spf13/afero](https://pkg.go.dev/github.com/spf13/afero) ([Apache-2.0](https://github.com/spf13/afero/blob/v1.15.0/LICENSE.txt))
- - [github.com/spf13/cast](https://pkg.go.dev/github.com/spf13/cast) ([MIT](https://github.com/spf13/cast/blob/v1.10.0/LICENSE))
- - [github.com/spf13/cobra](https://pkg.go.dev/github.com/spf13/cobra) ([Apache-2.0](https://github.com/spf13/cobra/blob/v1.10.1/LICENSE.txt))
- - [github.com/spf13/pflag](https://pkg.go.dev/github.com/spf13/pflag) ([BSD-3-Clause](https://github.com/spf13/pflag/blob/v1.0.10/LICENSE))
- - [github.com/spf13/viper](https://pkg.go.dev/github.com/spf13/viper) ([MIT](https://github.com/spf13/viper/blob/v1.21.0/LICENSE))
- - [github.com/subosito/gotenv](https://pkg.go.dev/github.com/subosito/gotenv) ([MIT](https://github.com/subosito/gotenv/blob/v1.6.0/LICENSE))
- - [github.com/wk8/go-ordered-map/v2](https://pkg.go.dev/github.com/wk8/go-ordered-map/v2) ([Apache-2.0](https://github.com/wk8/go-ordered-map/blob/v2.1.8/LICENSE))
- - [github.com/yosida95/uritemplate/v3](https://pkg.go.dev/github.com/yosida95/uritemplate/v3) ([BSD-3-Clause](https://github.com/yosida95/uritemplate/blob/v3.0.2/LICENSE))
- - [github.com/yudai/golcs](https://pkg.go.dev/github.com/yudai/golcs) ([MIT](https://github.com/yudai/golcs/blob/ecda9a501e82/LICENSE))
- - [go.yaml.in/yaml/v3](https://pkg.go.dev/go.yaml.in/yaml/v3) ([MIT](https://github.com/yaml/go-yaml/blob/v3.0.4/LICENSE))
- - [golang.org/x/exp](https://pkg.go.dev/golang.org/x/exp) ([BSD-3-Clause](https://cs.opensource.google/go/x/exp/+/8a7402ab:LICENSE))
- - [golang.org/x/sys/unix](https://pkg.go.dev/golang.org/x/sys/unix) ([BSD-3-Clause](https://cs.opensource.google/go/x/sys/+/v0.31.0:LICENSE))
- - [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) ([BSD-3-Clause](https://cs.opensource.google/go/x/text/+/v0.28.0:LICENSE))
- - [golang.org/x/time/rate](https://pkg.go.dev/golang.org/x/time/rate) ([BSD-3-Clause](https://cs.opensource.google/go/x/time/+/v0.5.0:LICENSE))
- - [gopkg.in/yaml.v2](https://pkg.go.dev/gopkg.in/yaml.v2) ([Apache-2.0](https://github.com/go-yaml/yaml/blob/v2.4.0/LICENSE))
- - [gopkg.in/yaml.v3](https://pkg.go.dev/gopkg.in/yaml.v3) ([MIT](https://github.com/go-yaml/yaml/blob/v3.0.1/LICENSE))
+ - [github.com/go-openapi/jsonpointer](https://pkg.go.dev/github.com/go-openapi/jsonpointer) ([Apache-2.0](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/go-openapi/jsonpointer/LICENSE))
+ - [github.com/go-openapi/swag](https://pkg.go.dev/github.com/go-openapi/swag) ([Apache-2.0](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/go-openapi/swag/LICENSE))
+ - [github.com/go-viper/mapstructure/v2](https://pkg.go.dev/github.com/go-viper/mapstructure/v2) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/go-viper/mapstructure/v2/LICENSE))
+ - [github.com/google/go-github/v71/github](https://pkg.go.dev/github.com/google/go-github/v71/github) ([BSD-3-Clause](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/google/go-github/v71/LICENSE))
+ - [github.com/google/go-github/v76/github](https://pkg.go.dev/github.com/google/go-github/v76/github) ([BSD-3-Clause](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/google/go-github/v76/LICENSE))
+ - [github.com/google/go-querystring/query](https://pkg.go.dev/github.com/google/go-querystring/query) ([BSD-3-Clause](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/google/go-querystring/LICENSE))
+ - [github.com/google/uuid](https://pkg.go.dev/github.com/google/uuid) ([BSD-3-Clause](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/google/uuid/LICENSE))
+ - [github.com/gorilla/css/scanner](https://pkg.go.dev/github.com/gorilla/css/scanner) ([BSD-3-Clause](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/gorilla/css/LICENSE))
+ - [github.com/gorilla/mux](https://pkg.go.dev/github.com/gorilla/mux) ([BSD-3-Clause](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/gorilla/mux/LICENSE))
+ - [github.com/invopop/jsonschema](https://pkg.go.dev/github.com/invopop/jsonschema) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/invopop/jsonschema/COPYING))
+ - [github.com/josephburnett/jd/v2](https://pkg.go.dev/github.com/josephburnett/jd/v2) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/josephburnett/jd/LICENSE))
+ - [github.com/josharian/intern](https://pkg.go.dev/github.com/josharian/intern) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/josharian/intern/license.md))
+ - [github.com/mailru/easyjson](https://pkg.go.dev/github.com/mailru/easyjson) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/mailru/easyjson/LICENSE))
+ - [github.com/mark3labs/mcp-go](https://pkg.go.dev/github.com/mark3labs/mcp-go) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/mark3labs/mcp-go/LICENSE))
+ - [github.com/microcosm-cc/bluemonday](https://pkg.go.dev/github.com/microcosm-cc/bluemonday) ([BSD-3-Clause](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/microcosm-cc/bluemonday/LICENSE.md))
+ - [github.com/migueleliasweb/go-github-mock/src/mock](https://pkg.go.dev/github.com/migueleliasweb/go-github-mock/src/mock) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/migueleliasweb/go-github-mock/LICENSE))
+ - [github.com/pelletier/go-toml/v2](https://pkg.go.dev/github.com/pelletier/go-toml/v2) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/pelletier/go-toml/v2/LICENSE))
+ - [github.com/sagikazarmark/locafero](https://pkg.go.dev/github.com/sagikazarmark/locafero) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/sagikazarmark/locafero/LICENSE))
+ - [github.com/shurcooL/githubv4](https://pkg.go.dev/github.com/shurcooL/githubv4) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/shurcooL/githubv4/LICENSE))
+ - [github.com/shurcooL/graphql](https://pkg.go.dev/github.com/shurcooL/graphql) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/shurcooL/graphql/LICENSE))
+ - [github.com/sourcegraph/conc](https://pkg.go.dev/github.com/sourcegraph/conc) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/sourcegraph/conc/LICENSE))
+ - [github.com/spf13/afero](https://pkg.go.dev/github.com/spf13/afero) ([Apache-2.0](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/spf13/afero/LICENSE.txt))
+ - [github.com/spf13/cast](https://pkg.go.dev/github.com/spf13/cast) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/spf13/cast/LICENSE))
+ - [github.com/spf13/cobra](https://pkg.go.dev/github.com/spf13/cobra) ([Apache-2.0](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/spf13/cobra/LICENSE.txt))
+ - [github.com/spf13/pflag](https://pkg.go.dev/github.com/spf13/pflag) ([BSD-3-Clause](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/spf13/pflag/LICENSE))
+ - [github.com/spf13/viper](https://pkg.go.dev/github.com/spf13/viper) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/spf13/viper/LICENSE))
+ - [github.com/subosito/gotenv](https://pkg.go.dev/github.com/subosito/gotenv) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/subosito/gotenv/LICENSE))
+ - [github.com/wk8/go-ordered-map/v2](https://pkg.go.dev/github.com/wk8/go-ordered-map/v2) ([Apache-2.0](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/wk8/go-ordered-map/v2/LICENSE))
+ - [github.com/yosida95/uritemplate/v3](https://pkg.go.dev/github.com/yosida95/uritemplate/v3) ([BSD-3-Clause](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/yosida95/uritemplate/v3/LICENSE))
+ - [github.com/yudai/golcs](https://pkg.go.dev/github.com/yudai/golcs) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/github.com/yudai/golcs/LICENSE))
+ - [go.yaml.in/yaml/v3](https://pkg.go.dev/go.yaml.in/yaml/v3) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/go.yaml.in/yaml/v3/LICENSE))
+ - [golang.org/x/exp](https://pkg.go.dev/golang.org/x/exp) ([BSD-3-Clause](https://github.com/github/github-mcp-server/blob/HEAD/vendor/golang.org/x/exp/LICENSE))
+ - [golang.org/x/net/html](https://pkg.go.dev/golang.org/x/net/html) ([BSD-3-Clause](https://github.com/github/github-mcp-server/blob/HEAD/vendor/golang.org/x/net/LICENSE))
+ - [golang.org/x/sys/unix](https://pkg.go.dev/golang.org/x/sys/unix) ([BSD-3-Clause](https://github.com/github/github-mcp-server/blob/HEAD/vendor/golang.org/x/sys/LICENSE))
+ - [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) ([BSD-3-Clause](https://github.com/github/github-mcp-server/blob/HEAD/vendor/golang.org/x/text/LICENSE))
+ - [golang.org/x/time/rate](https://pkg.go.dev/golang.org/x/time/rate) ([BSD-3-Clause](https://github.com/github/github-mcp-server/blob/HEAD/vendor/golang.org/x/time/LICENSE))
+ - [gopkg.in/yaml.v2](https://pkg.go.dev/gopkg.in/yaml.v2) ([Apache-2.0](https://github.com/github/github-mcp-server/blob/HEAD/vendor/gopkg.in/yaml.v2/LICENSE))
+ - [gopkg.in/yaml.v3](https://pkg.go.dev/gopkg.in/yaml.v3) ([MIT](https://github.com/github/github-mcp-server/blob/HEAD/vendor/gopkg.in/yaml.v3/LICENSE))
 
 [github/github-mcp-server]: https://github.com/github/github-mcp-server