代理框架
GitHub Agentic Workflows 0.89 Series Adds MCP Call Tracing and Narrows Workflow Credential Exposure
GitHub released 17 `gh-aw` versions in one week, enabling JSON logs to identify the server, tool, and timestamp for each MCP call. The latest patch also stops persistently storing `GITHUB_TOKEN` in the slash command router’s Git configuration, though the 0.89 series remains on a prerelease cadence.
On September 14, GitHub summarized a week of changes spanning Agentic Workflows (`gh-aw`) versions 0.88.5 through 0.89.12. This GitHub CLI extension compiles agentic workflows described in Markdown into GitHub Actions. The most operationally valuable changes in this round make MCP tool usage and credential boundaries easier to audit.
In 0.89.0, `gh aw logs --json` now records the timestamp, server name, and tool name for every MCP call. Previously, when a workflow connected to a code repository, issue tracker, and external search service at the same time, aggregate usage data made it difficult to determine which tool was responsible for anomalous traffic. The new fields allow SIEM systems, cost analysis tools, and post-incident investigations to build per-tool traces. `--ignore-workflow-runs` can exclude specified runs without reducing the requested number of results, while `--cached-json` overwrites the old cache after a successful fetch, reducing the risk of analyzing stale data.
On reliability, custom agent engines could previously cause threat detection to incorrectly report `config_error` and skip analysis; this has now been fixed. The built-in MCP gateway has been upgraded to 0.4.20, with model aliases and pricing-catalog recognition added for GPT-6 Astra. The subsequent 0.89.12 release sets checkout in the centralized slash command router to `persist-credentials: false`, preventing `GITHUB_TOKEN` from remaining in the local Git configuration for the router’s entire runtime and reducing the scope in which later steps or injected commands could read the credential.
These changes improve observability and defense in depth; they do not mean that MCP tools themselves are secure, nor do they establish least-privilege access for deployers. After upgrading, teams should recompile pinned workflows, confirm that JSON consumers accept the new fields, and check whether self-hosted routers still persist tokens manually. The official versioning policy also states that new minor releases initially float as prereleases, so production environments should pin a validated version.