Skip to content

Set steering-committee and its child teams to triage on servers, inspector and quickstart-resources - #244

Open
PederHP wants to merge 2 commits into
modelcontextprotocol:mainfrom
PederHP:servers-least-privilege
Open

PederHP wants to merge 2 commits into
modelcontextprotocol:mainfrom
PederHP:servers-least-privilege

Conversation

@PederHP

@PederHP PederHP commented Nov 10, 2026 •

Copy link
Copy Markdown
Member

Permissions clean-up for servers, inspector and quickstart-resources, in line with the contributor ladder's "merge privileges for owned areas".

Before: steering-committee has push on all three repositories, and so do its child teams listed in each entry (SDK teams, sdk-maintainers, auth-maintainers, registry-wg, transport-wg and others). Because child teams inherit from their parent, about 126 people in this config have write access or higher on each repository. Most of them have no role in it.

After: Those grants are triage, the same level these teams have on modelcontextprotocol and .github. They can still label, assign, and close issues and pull requests, and anyone can still contribute through a fork. Write access comes from the team that owns each repository, plus the grants this PR leaves alone:

Repository Owning team, unchanged Write or higher, before After
servers reference-servers-maintainers (admin) 127 25
inspector inspector-maintainers (admin) 126 26
quickstart-resources docs-maintainers (push) 126 28

Unchanged on all three: core-maintainers and lead-maintainers (all_repo_admin org role), moderators (maintain), and security-ig (admin; reviewing that grant is already tracked separately, see the README). docs is archived and left as it is.

Impact on current work, from recent pull requests on each repository:

  • servers (last 600, since 2026-06-30): every branch pushed to the repository came from a reference servers maintainer or a bot. All but one merge was made by someone who keeps write access; the exception was a single merge by a docs-maintainers member.
  • inspector (last 400, since 2026-08-20): every in-repo branch and every merge came from someone who keeps write access, or a bot.
  • quickstart-resources (all 223): most merges are by a docs-maintainers member, which is why that team keeps push. Two people lose write access they have used: one in-repo branch from an mcpb-maintainers member and two merges by a ruby-sdk member. Both can keep contributing through forks.

How: In the three entries of src/config/repoAccess.ts, changes push to triage for steering-committee and each listed child team, except docs-maintainers on quickstart-resources. The set of teams listed is unchanged, so the pulumi preview should show only permission updates on repo-servers, repo-inspector and repo-quickstart-resources. Updates the inheritance note in the README to match.

npm run check passes (format, validate, 79 tests).

🤖 Generated with Claude Code

https://claude.ai/code/session_01MqPQYQV9o5rePatonDBsmh

Write access on servers now comes from the teams that own or operate the
repository: reference-servers-maintainers, core-maintainers, moderators
and security-ig. steering-committee and the SDK, working-group and docs
teams nested under it move from push to triage, matching how they are
configured on modelcontextprotocol and .github.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MqPQYQV9o5rePatonDBsmh
@PederHP
PederHP requested a review from a team as a code owner November 10, 2026 19:44
steering-committee and its child teams move from push to triage on
inspector and quickstart-resources as well. inspector-maintainers keeps
admin on inspector, and docs-maintainers keeps push on
quickstart-resources, where its members do most of the merging.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MqPQYQV9o5rePatonDBsmh
@PederHP PederHP changed the title Set steering-committee and its child teams to triage on servers Set steering-committee and its child teams to triage on servers, inspector and quickstart-resources Nov 10, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant