Add a small custom MCP review-operations layer

[chaodu-agent]

Context

Agent workflows are moving away from the GitHub CLI. ghpool already provides the GitHub MCP transport, but it currently proxies the upstream GitHub MCP schemas and does not expose comment minimization (minimizeComment) or a few other review-lifecycle operations needed by the OpenAB review workflow.

We should add a small, explicitly scoped set of ghpool-owned MCP tools rather than requiring agents to fall back to gh api graphql or the GitHub CLI.

Proposal

Extend ghpool's MCP proxy with a namespaced ghpool_review_* operation layer:

• tools/list returns the upstream GitHub tools plus the enabled custom tools.
• tools/call dispatches ghpool-owned tools locally and continues proxying all other tools upstream.
• Custom operations use ghpool's existing scoped GitHub App credential, agent/repository policy, write gate, and durable audit trail.
• Do not expose a generic arbitrary GraphQL tool.

Initial MVP

1. ghpool_review_minimize_comment
   • Inputs: comment_node_id, classifier (default: OUTDATED)
   • Calls GitHub GraphQL minimizeComment.
2. ghpool_review_restore_comment
   • Input: comment_node_id
   • Calls GitHub GraphQL unminimizeComment.
3. ghpool_review_delete_pending
   • Deletes a stale or partial pending pull-request review.
4. ghpool_review_submit
   • Submits an existing pending review with APPROVE, REQUEST_CHANGES, or COMMENT.
5. ghpool_commit_status_set
   • Creates or updates the exact-SHA review status gate.

The first two operations are the immediate gap; the remaining operations provide a small, coherent review lifecycle and remove the current CLI/API fallback for review automation.

Security and behavior requirements

• Custom tools must be namespaced to avoid collisions with upstream GitHub MCP tools.
• They must be default-deny and require explicit inclusion in the agent tool allowlist.
• Write calls must retain the existing App-backed credential requirement, repository allowlist, fail-closed audit, and in-flight limits.
• Repository ownership must be derived from validated arguments or the comment/review node, never from an agent-selected installation.
• Operations should be idempotent where possible and return structured success/error results.
• Tool schemas and behavior should be documented, with unit and MCP integration tests covering authorization, repository isolation, audit records, and upstream-tool compatibility.

Alternatives considered

• A separate review-operations MCP server would keep ghpool's proxy simpler, but would require separate credential and policy plumbing.
• A generic GraphQL MCP tool would be easier to add but would weaken the default-deny model and make mutation auditing less precise.

Acceptance criteria

• An MCP client can minimize and restore an eligible GitHub issue/PR comment without GitHub CLI access.
• An MCP client can complete the review/status lifecycle needed by OpenAB's automated review workflow.
• Unauthorized agents and repositories cannot invoke the custom tools.
• Existing upstream GitHub MCP tools continue to work unchanged.
• The implementation has no dependency on the GitHub CLI.