Fix dispatch_workflow tool registration in Safe Outputs MCP HTTP server

[Copilot]

Problem

The Safe Outputs MCP HTTP server failed to register dispatch_workflow tools, preventing workflow dispatch invocations via the Copilot agent. Gateway logs showed only 3 tools registered from safeoutputs (missing_tool, noop, missing_data) despite test_workflow being present in tools.json.

Root Cause

dispatch_workflow tools use workflow-specific names with _workflow_name metadata:

{
  "name": "test_workflow",              // Tool name (normalized)
  "_workflow_name": "test-workflow",    // Workflow identifier
  "description": "Dispatch the 'test-workflow' workflow..."
}

But config uses a single dispatch_workflow key:

{
  "dispatch_workflow": {
    "workflows": ["test-workflow"],
    "max": 1
  }
}

The HTTP server's registration loop checked if tool.name existed in config keys (enabledTools.has("test_workflow")), which failed because only "dispatch_workflow" was in the set.

The stdio server already handled this correctly via registerPredefinedTools(), but the HTTP server had reimplemented registration without this logic.

Changes

actions/setup/js/safe_outputs_mcp_server_http.cjs

Added dispatch_workflow tool detection before the config key check:

const isDispatchWorkflowTool = !!tool._workflow_name;

if (isDispatchWorkflowTool) {
  if (!safeOutputsConfig.dispatch_workflow) {
    logger.debug(`WARNING: dispatch_workflow config missing - tool NOT registered`);
    continue;
  }
  logger.debug(`dispatch_workflow config exists, registering tool`);
} else {
  if (!enabledTools.has(tool.name)) {
    logger.debug(`Skipping tool ${tool.name} - not enabled in config`);
    continue;
  }
}

actions/setup/js/safe_outputs_mcp_server_http_dispatch.test.cjs (new)

Tests validate:

• dispatch_workflow tools register when config.dispatch_workflow exists
• dispatch_workflow tools skip when config is missing
• Regular tools continue to work via config key matching

Impact

Fixes dispatch_workflow safe outputs for Copilot engine workflows using MCP gateway HTTP transport. Stdio transport workflows were unaffected.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/githubnext/gh-aw/actions/artifacts/5336556283/zip
  • Triggering command: /usr/bin/curl curl -L -H Accept: application/vnd.github+json -H Authorization: ****** X-GitHub-Api-Version: 2022-11-28 REDACTED -o agent-artifacts.zip (http block)
• https://api.github.com/repos/githubnext/gh-aw/actions/runs/21572314506/logs
  • Triggering command: /usr/bin/curl curl -L -H Accept: application/vnd.github+json -H Authorization: ****** X-GitHub-Api-Version: 2022-11-28 REDACTED -o workflow-logs.zip (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Reference: https://github.com/githubnext/gh-aw/actions/runs/21572314506/job/62153376520

Review gateway logs to debug why the dispatch_workflow workflow tool is not invoked.

Custom agent used: agentic-workflows
GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

---

Changeset

• Type: patch
• Description: Added a regression test so the safe outputs HTTP server registers tools that carry _workflow_name metadata when dispatch_workflow is configured.

Ahoy! This treasure was crafted by 🏴‍☠️ Changeset Generator

[github-actions]

🔍 PR Triage Results

Category: bug | Risk: high | Priority: 72/100

Scores Breakdown

• Impact: 45/50 - Critical fix for dispatch_workflow tool registration in Safe Outputs MCP HTTP server
• Urgency: 20/30 - High - prevents workflow dispatch safe outputs from working
• Quality: 7/20 - Fair - draft status, includes comprehensive tests

📋 Recommended Action: fast-track

Critical bug fix - The HTTP server wasn't detecting dispatch_workflow tools because it checked for tool names in config keys, but dispatch_workflow uses workflow-specific tool names. This fix adds detection via _workflow_name metadata field.

Priority review needed to unblock safe outputs dispatch functionality.

---

Triaged by PR Triage Agent on 2026-02-02

AI generated by PR Triage Agent

[github-actions]

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

[github-actions]

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

[github-actions]

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

[github-actions]

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

[github-actions]

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.52.0
jq	✅	1.7
yq	✅	4.50.1
curl	✅	8.5.0
gh	✅	2.86.0
node	✅	24.13.0
python3	✅	3.13.11
go	✅	1.24.12
java	❌	not found
dotnet	❌	not found

Result: 10/12 tools available ⚠️

Missing Tools:

• java - Java runtime not installed
• dotnet - .NET runtime not installed

Status: PARTIAL - Core development tools (bash, git, node, python, go) are available. Java and .NET runtimes are missing but may not be required for typical workflows.

AI generated by Agent Container Smoke Test

[github-actions]

Smoke Test Complete ✅

• ✅ GitHub MCP (Add absolute path validation for MCP gateway payloadDir field #13183, Refactor compiler to use grouped shell redirects (fix SC2129) #13182)
• ✅ Safe Inputs GH CLI
• ✅ Serena MCP
• ✅ Playwright
• ✅ File Writing & Bash
• ✅ Discussion ([Auto-Triage] Auto-Triage Report - February 2, 2026 #13186)
• ✅ Build gh-aw
• ✅ Workflow Dispatch

Status: PASS

@pelikhan @Copilot

AI generated by Smoke Copilot

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

Smoke test (Codex) summary:
Merged PRs: Remove version numbers from frontmatter hash computation; Add payloadDir field to MCP Gateway configuration
PR list: Add absolute path validation for MCP gateway payloadDir field; Refactor compiler to use grouped shell redirects (fix SC2129)
GitHub MCP ✅; safeinputs-gh ✅
Serena activate ✅; Playwright title ✅
Tavily search ✅; File write+cat ✅
Build gh-aw ✅; Discussion comment ✅
Overall: PASS

AI generated by Smoke Codex