parse lockdown header and update GetFlags to retrieve ff from ctx

Author: kerobbi

pkg/github/dependencies.go

@@ -86,7 +86,7 @@ type ToolDependencies interface {
 	GetT() translations.TranslationHelperFunc
 
 	// GetFlags returns feature flags
-	GetFlags() FeatureFlags
+	GetFlags(ctx context.Context) FeatureFlags
 
 	// GetContentWindowSize returns the content window size for log truncation
 	GetContentWindowSize() int
@@ -153,7 +153,7 @@ func (d BaseDeps) GetRepoAccessCache(_ context.Context) (*lockdown.RepoAccessCac
 func (d BaseDeps) GetT() translations.TranslationHelperFunc { return d.T }
 
 // GetFlags implements ToolDependencies.
-func (d BaseDeps) GetFlags() FeatureFlags { return d.Flags }
+func (d BaseDeps) GetFlags(_ context.Context) FeatureFlags { return d.Flags }
 
 // GetContentWindowSize implements ToolDependencies.
 func (d BaseDeps) GetContentWindowSize() int { return d.ContentWindowSize }
@@ -344,7 +344,11 @@ func (d *RequestDeps) GetRepoAccessCache(ctx context.Context) (*lockdown.RepoAcc
 func (d *RequestDeps) GetT() translations.TranslationHelperFunc { return d.T }
 
 // GetFlags implements ToolDependencies.
-func (d *RequestDeps) GetFlags() FeatureFlags { return d.Flags }
+func (d *RequestDeps) GetFlags(ctx context.Context) FeatureFlags {
+	return FeatureFlags{
+		LockdownMode: ghcontext.IsLockdownMode(ctx),
+	}
+}
 
 // GetContentWindowSize implements ToolDependencies.
 func (d *RequestDeps) GetContentWindowSize() int { return d.ContentWindowSize }

pkg/github/issues.go

@@ -334,7 +334,7 @@ func GetIssue(ctx context.Context, client *github.Client, deps ToolDependencies,
 	if err != nil {
 		return nil, fmt.Errorf("failed to get repo access cache: %w", err)
 	}
-	flags := deps.GetFlags()
+	flags := deps.GetFlags(ctx)
 
 	issue, resp, err := client.Issues.Get(ctx, owner, repo, issueNumber)
 	if err != nil {
@@ -389,7 +389,7 @@ func GetIssueComments(ctx context.Context, client *github.Client, deps ToolDepen
 	if err != nil {
 		return nil, fmt.Errorf("failed to get repo access cache: %w", err)
 	}
-	flags := deps.GetFlags()
+	flags := deps.GetFlags(ctx)
 
 	opts := &github.IssueListCommentsOptions{
 		ListOptions: github.ListOptions{
@@ -449,7 +449,7 @@ func GetSubIssues(ctx context.Context, client *github.Client, deps ToolDependenc
 	if err != nil {
 		return nil, fmt.Errorf("failed to get repo access cache: %w", err)
 	}
-	featureFlags := deps.GetFlags()
+	featureFlags := deps.GetFlags(ctx)
 
 	opts := &github.IssueListOptions{
 		ListOptions: github.ListOptions{

pkg/github/pullrequests.go

@@ -139,7 +139,7 @@ func GetPullRequest(ctx context.Context, client *github.Client, deps ToolDepende
 	if err != nil {
 		return nil, fmt.Errorf("failed to get repo access cache: %w", err)
 	}
-	ff := deps.GetFlags()
+	ff := deps.GetFlags(ctx)
 
 	pr, resp, err := client.PullRequests.Get(ctx, owner, repo, pullNumber)
 	if err != nil {
@@ -350,7 +350,7 @@ func GetPullRequestReviewComments(ctx context.Context, gqlClient *githubv4.Clien
 	if err != nil {
 		return nil, fmt.Errorf("failed to get repo access cache: %w", err)
 	}
-	ff := deps.GetFlags()
+	ff := deps.GetFlags(ctx)
 
 	// Convert pagination parameters to GraphQL format
 	gqlParams, err := pagination.ToGraphQLParams()
@@ -437,7 +437,7 @@ func GetPullRequestReviews(ctx context.Context, client *github.Client, deps Tool
 	if err != nil {
 		return nil, fmt.Errorf("failed to get repo access cache: %w", err)
 	}
-	ff := deps.GetFlags()
+	ff := deps.GetFlags(ctx)
 
 	reviews, resp, err := client.PullRequests.ListReviews(ctx, owner, repo, pullNumber, nil)
 	if err != nil {

pkg/http/handler.go

@@ -105,6 +105,10 @@ func withToolset(next http.Handler) http.Handler {
 }
 
 func (h *HTTPMcpHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if relaxedParseBool(r.Header.Get(headers.MCPLockdownHeader)) {
+		r = r.WithContext(ghcontext.WithLockdownMode(r.Context(), true))
+	}
+
 	inventory := h.inventoryFactoryFunc(r)
 
 	ghServer, err := h.githubMcpServerFactory(r.Context(), r, h.deps, inventory, &github.MCPServerConfig{

pkg/http/headers/headers.go

@@ -32,6 +32,8 @@ const (
 	MCPToolsetsHeader = "X-MCP-Toolsets"
 	// MCPToolsHeader is a comma-separated list of MCP tools that the request is for.
 	MCPToolsHeader = "X-MCP-Tools"
+	// MCPLockdownHeader indicates whether lockdown mode is enabled.
+	MCPLockdownHeader = "X-MCP-Lockdown"
 	// MCPFeaturesHeader is a comma-separated list of feature flags to enable.
 	MCPFeaturesHeader = "X-MCP-Features"
 )