Defame1297
18ec0ab0ff
SKILL.md, README.md, and references/{branches,commits}.md claimed
list_branches, list_commits, and get_commit "work with write:issue
alone." This contradicted docs/research/docs/gitea/overview.md, which
documents write:repository as gating both reads and writes for
repo-scoped tool families (Gitea hides these reads behind write
scope). The prior empirical justification was invalid: it tested under
a token holding both write:issue and write:repository simultaneously,
which doesn't isolate which scope actually enabled the reads.
Corrected all four files to state that list_branches, create_branch,
and delete_branch require write:repository, confirmed directly by
overview.md's scope enumeration. list_commits/get_commit are flagged
as inferred to need the same scope by analogy rather than an
overview.md-confirmed fact, since overview.md's write:repository
enumeration names PR/branch/file/release/tag but not commits — this
distinction surfaced during an independent audit pass and is now
called out explicitly so the claim isn't overstated.
Bumped SKILL.md metadata.version 0.1.0 -> 0.1.1 (patch: doc
correction, no behavior change).
3.1 KiB
topic, source_keys
| topic | source_keys | ||
|---|---|---|---|
| branches |
|
Branch operations
Call signatures below were verified live against the deployed gitea-mcp server via ToolSearch
at authoring time, not copied from research docs — this is deliberate: research docs are generated
from source code at a point in time and can drift from the server actually deployed. Re-verify
against the live schema if these tools appear to behave differently than documented here.
list_branches
Parameters:
owner(string, required)repo(string, required)page(number, optional, default:1)per_page(number, optional, default:30)
Call:
list_branches owner: <owner> repo: <repo>
Response: one object per branch: name, protected (bool), commit_sha (present when the
underlying commit data is available).
Paginate if you need the full list (see Gotchas in SKILL.md) — iterate page until the returned
count is less than per_page.
create_branch
Parameters:
owner(string, required)repo(string, required)branch(string, required) — new branch nameold_branch(string, optional) — source branch; if omitted, defaults to the repo's default branch server-side (not necessarily your current local checkout)
Call:
create_branch owner: <owner> repo: <repo> branch: <new-name> old_branch: <source-branch>
Default dispatch: if the user gives a base ("branch off of X", "from X"), pass it as old_branch.
If they don't specify a base and you're mid-task on a local branch, pass your current branch
(git branch --show-current) as old_branch so the new branch forks from where you're actually
working, rather than silently falling back to the repo default. If neither applies (e.g. a fresh
top-level request with no working branch context), omit old_branch and let it default server-side.
A branch name collision returns 409 Conflict.
delete_branch
Parameters:
owner(string, required)repo(string, required)branch(string, required)
Call:
delete_branch owner: <owner> repo: <repo> branch: <name>
Before calling this, see the hard-refusal Gotcha in SKILL.md. If the target branch's name isn't
obviously a scratch/feature branch, call list_branches first and check protected on the
matching entry — name-matching main/master alone isn't authoritative, since a repo can protect
a differently-named default branch. Confirm explicitly with the user before deleting anything
protected, every time, regardless of how the request is phrased.
Token scope
All three — list_branches, create_branch, delete_branch — require write:repository. Gitea
gates reads behind write scope for repo-scoped operations, so list_branches needs the same scope
as the write operations, not write:issue alone. An earlier version of this doc claimed
write:issue alone was sufficient for list_branches, based on empirical testing under a token
that held both write:issue and write:repository simultaneously — that test didn't isolate the
variable, so it couldn't actually establish write:issue alone as sufficient.