* Add security-managers org role and assign maxisbey
Model GitHub's pre-defined security_manager organization role in the
IaC: new GitHub-only security-managers team wired to the org role via
ORG_ROLE_ASSIGNMENTS, following the existing all_repo_admin pattern.
Add Max Isbey (maxisbey) as its first member so he can view draft
security advisories for coordinated disclosure work.
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0147Pp292yN9cQKCQBphVyMy
* Add jenn-newton to security-managers team
Paul Carleton asked for Jenn to join the new security-managers team
alongside Max Isbey. Resolved to Jenn Newton (jenn-newton), already a
member of the security working group in this config.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Declare allowExternalMembers on managed group settings
Every pulumi up was resetting the Google Workspace per-group setting
ALLOW_EXTERNAL_MEMBERS to false on all managed groups, because the
GroupSettings resources never declared allowExternalMembers and the
provider (SamuZad/googleworkspace 0.11.1) defaults the field to false.
Google then silently purges external-email members from affected groups
roughly 1-2 days after each apply, with no audit events.
Pin the setting to true for all managed groups. External membership
itself remains governed exclusively by config/users.ts entries; this
setting only permits it.
Part of the #133 incident.
* Scope allowExternalMembers per group, derived from membership config
Instead of permitting external members on every managed group, derive
allowExternalMembers per group: true only for groups whose membership
config (config/users.ts) resolves at least one member to a
non-@modelcontextprotocol.io email. Email resolution is factored into
resolveGoogleMemberEmail and shared with GroupMember creation so the
two cannot drift. The field stays declared on every group because the
provider defaults it to false on each apply, after which Google
silently purges external members (#133 incident).
With current config, exactly these groups derive true: maintainers,
registry-wg, antitrust, catch-all. A config test pins this set so
changes to it are always deliberate.
* Make allowExternalMembers an explicit per-role opt-in with config validation
Replace the derived per-group allowExternalMembers (computed from
membership config) with an explicit opt-in: group owners set
allowExternalMembers: true on the role's google config in
src/config/roles.ts, and src/google.ts passes it straight through to
GroupSettings (defaulting to false). The field stays declared on every
group because the provider resets an omitted field to false on each
apply, after which Google silently purges external members (#133).
Roles opting in, matching current membership: maintainers,
registry-maintainers (registry-wg), antitrust, catch-all.
A validate-config check replaces the old pinned-set test: it fails with
an actionable error whenever a group has a member resolving to a
non-@modelcontextprotocol.io email but its role does not opt in, naming
the group, the member email, and the exact config line to add.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Both Workspace accounts (ajr@ and ochafik@modelcontextprotocol.io) were
created manually in Google Workspace; mark them with existingGWSUser so
Pulumi skips creating the User resources.
Co-authored-by: Claude <noreply@anthropic.com>
Elevates the inspector-maintainers team from push to admin on the
inspector repository, in parity with the SDK teams and the
reference-servers-maintainers team, which hold admin on the repos
they own.
Claude-Session: https://claude.ai/code/session_01W6EqMj921DKTJJtiPpCGNE
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds appeals@modelcontextprotocol.io as an email Google Group so banned
or external users have an out-of-band channel to appeal Code of Conduct
actions even after an org-level GitHub block. Mirrors the existing
antitrust@/catch-all@ email-group setup (isEmailGroup, no new GoogleConfig
fields).
Membership is curated explicitly (like the antitrust@ members) to the
current moderators and active lead maintainers, rather than derived from
the MODERATORS/LEAD_MAINTAINERS roles, since those roles include emeritus
and former members who should not receive appeals.
Co-authored-by: Tadas Antanavicius <tadas@modelcontextprotocol.io>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com>
* Add evalstate and cliffhall to docs-maintaners team
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* feat(users): add olaservo to interceptors-wg
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Den Delimarsky <53200638+localden@users.noreply.github.com>
- GroupSettings: ignoreChanges on isArchived (upstream
hashicorp/terraform-provider-googleworkspace#398)
- OrgUnit: drop the stale import option; it was only needed for the
initial adopt and now triggers a re-compare on every preview
example-remote-server was missing from the repository access config, so
with the org default repository permission set to 'none', no team had
write access to it. Add it alongside its sibling example-remote-client,
mirroring the team grants used for ext-apps (the apps surface these
example servers belong to): core-maintainers push, moderators maintain,
mcp-apps-wg push, mcp-apps-sdk admin.
* chore: align registry roster with WG charter
Aligns GitHub teams / Discord roles / Google groups with the Registry
Working Group charter (https://modelcontextprotocol.io/community/registry/charter):
- Add REGISTRY_WG_COLLABORATORS role + registry-wg-collaborators GitHub
team with push (not admin) on the registry repo, mirroring the
typescript-sdk-collaborators model. No google config => no
@modelcontextprotocol.io account (charter: Maintainer? No).
- Add Preeti (Pree) Dewani (@pree-dew) as a registry collaborator.
- Remove Adam Jones (@domdomegg) from REGISTRY_MAINTAINERS (he remains an
active MCPB maintainer). His @modelcontextprotocol.io account is
unaffected (existingGWSUser, not managed by this IaC).
- Remove Toby Padilla (@toby) entirely; registry was his only
maintainership. His @modelcontextprotocol.io account is likewise
unaffected by this change (existingGWSUser).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore: drop discord config and inline comments from collaborators role
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore: annotate registry collaborators role id as GitHub only
Matches the typescript-sdk-collaborators convention in roleIds.ts.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore: keep Toby as registry emeritus with empty role membership
Instead of removing Toby Padilla's access entry entirely, retain it with an
empty memberOf and a comment noting he is an emeritus maintainer of the
Registry.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore: rename registry collaborators team to registry-collaborators
Drops the '-wg' infix for consistency: GitHub team slug
'registry-wg-collaborators' -> 'registry-collaborators' and the role id
constant REGISTRY_WG_COLLABORATORS -> REGISTRY_COLLABORATORS, keeping the
constant and slug mirrored as with typescript-sdk-collaborators.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Tadas Antanavicius <tadas@modelcontextprotocol.io>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* Manage GitHub org settings and org-role assignments via Pulumi
Brings two click-ops org-level configs under IaC and tightens defaults:
- OrganizationSettings: default_repository_permission read -> none so
private repos are not implicitly readable by every member; repo
creation restricted to admins; billingEmail from Pulumi secret;
security new-repo defaults pinned so the provider does not reset them.
- Org-role assignments: codify lead/core-maintainers -> all_repo_admin.
moderators -> all_repo_triage and anthropic -> all_repo_write are
intentionally omitted (being removed).
* Fix config namespace: use project namespace for githubBillingEmail
The github: namespace is reserved for the @pulumi/github provider's own
config keys, so github:billingEmail was rejected as an unknown provider
option. Use the project default namespace instead. preview.yml uses the
same --config flag pattern as the existing Discord secrets.
Creates the agents-wg role and corresponding GitHub team under working-groups,
adds Caitie, David, Luca, and Peter Alexander as members, and grants the team
admin access to the experimental-ext-tasks repository.
Creates the file-uploads-wg GitHub team (under working-groups) and the
matching Discord role. Initial members: localden (Lead), nickcoai,
ochafik. See charter PR modelcontextprotocol#2635.
🏠 Remote-Dev: homespace
* Add INTERCEPTORS_WG role ID
* Add Interceptors Working Group role configuration
* Add repository access configuration for interceptors
* Add user to INTERCEPTORS_WG role
When a member wasn't in the guild at create() time (or drifted afterwards),
read() only reported the drift. Pulumi would not trigger update() because
the inputs hadn't changed, so the member stayed permanently out of sync.
Call syncMemberRoles() directly from read() when drift is detected so roles
are applied on the next refresh without needing an input change.
Add firstName, lastName, and googleEmailPrefix fields to provision
sam@modelcontextprotocol.io Google Workspace account.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Adds SERVER_CARD_WG working group with GitHub team and Discord role.
Adds Sam to MAINTAINERS and SERVER_CARD_WG, and adds tadasant and dsp-ant
to SERVER_CARD_WG.
- New GitHub team typescript-sdk-collaborators (child of typescript-sdk)
- Grant push permission on modelcontextprotocol/typescript-sdk
- Add poteat as initial member
🏠 Remote-Dev: homespace
- Expand REFERENCE_SERVERS_MAINTAINERS role (previously Discord-only) to
create a GitHub team
- Grant the team admin permission on modelcontextprotocol/servers
- Add tobinsouth as a new member
Existing members cliffhall and olaservo will also be added to the new
GitHub team.
🏠 Remote-Dev: homespace
Cloudflare edge errors (5xx, edge-level 429s) return plain-text bodies
like "upstream connect error..." or "error code: 1015" that crash a
naive response.json() call. Add a tryParseJson helper and use it for
all error paths so we surface the actual HTTP status/body instead of a
JSON parse exception.
Also add exponential backoff retry for 5xx responses, matching the
existing 429 retry behavior.
🏠 Remote-Dev: homespace
The csharp-sdk team only had push permission, which was insufficient for
members to push to protected branches, edit/assign issues, or have their
PR approvals count toward merge requirements. Upgrading to maintain grants
these capabilities without admin access.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Den Delimarsky <53200638+localden@users.noreply.github.com>
The 250ms jitter was too narrow for ~68 parallel refresh reads — all
retries clustered after the same retry_after and collided again. Scale
jitter linearly with attempt number so the herd progressively spreads
out across attempts.
