Add publisher listing for mcp.mail-server by yunfeizhu · Pull Request #3805 · hashgraph-online/hol-guard

yunfeizhu · 2026-10-09T05:47:28Z

What changed

The mcp.mail-server contribution merged in #3278, but its publisher profile cannot be claimed because it has no accepted numeric GitHub ID mapping. Add contributions/extension-listings/mcp.mail-server.json using guard.extension-listing.v2.

This PR proposes yunfeizhu (verified numeric GitHub ID 12027613) as the authorized publisher-profile manager through maintainerGithubIds. The mapping requires maintainer review and acceptance on canonical main before it can authorize a claim. Public credit is recorded separately in contributors.

Upstream source and version

Existing contribution: mcp.mail-server, version 1.0.0, merged in #3278.
Upstream: yunfeizhu/mcp-mail-server.
Original request: mcp-mail-server#14.

Capability boundary

This is a publisher metadata change for the existing public contribution ID mcp.mail-server (runtime ID command.mcp-mail-server). The listing describes the existing opt-in deletion-review coverage and its launch-identity limits. It does not change tool policy, activation, runtime trust, or upstream ownership. Only the new listing file is included; generated catalogs and projections remain maintainer-owned.

Fast validation

Validated the actual new file with the listing loader, public v2 JSON Schema, existing MCP contribution identity, and claim-notice accepted_github_ids validator.
Built the current source compiler with cargo +1.88.0 build --locked --manifest-path rust/Cargo.toml --release -p guard-command --bin guard-command-source.
Ran the existing listing and claim-notice tests: 109 passed.

HOL_GUARD_NATIVE_SOURCE_COMPILER="$PWD/rust/target/release/guard-command-source" \
  .venv/bin/pytest tests/test_guard_extension_builder_listing.py \
  tests/test_guard_extension_claim_notice.py -q

Checklist

The listing filename and extension ID match the existing MCP contribution.
No runtime source, fixtures, trust entries, or generated projections are changed.
The listing contains no private email, secrets, executable fields, or inferred claim authority.
The explicit numeric-ID mapping is submitted for maintainer review, separately from public attribution.

Summary by CodeRabbit

New Integrations
- Added a listing for the mail-server extension, describing optional review controls for message deletion and when mailbox listing and search may receive automatic allow defaults.
- Defaults require local administrator enablement and a matching launch identity. Custom grants on this device and stricter Guard policies take precedence; other tools remain subject to host settings.

greptile-apps · 2026-10-09T05:47:34Z

PR author is not in the allowed authors list.

coderabbitai · 2026-10-09T05:48:04Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: CHILL
Plan: Advanced
Run ID: e28ddfbd-6896-4751-9faf-5df5e9db36ae

📥 Commits

Reviewing files that changed from the base of the PR and between 6fc83e0 and 2f87bc1.

📒 Files selected for processing (1)

contributions/extension-listings/mcp.mail-server.json

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

📝 Walkthrough

Walkthrough

Adds an extension listing for mcp.mail-server. The listing describes deletion-review coverage, conditions for automatic read allowances, evidence limitations, and project attribution metadata.

Changes

Mail server extension listing

Layer / File(s)	Summary
Review and allowance declarations `contributions/extension-listings/mcp.mail-server.json`	The listing describes review of `delete_message` and `delete_messages`, conditional automatic read allowances, policy precedence, evidence limits, and project metadata.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 2f87b

The listing’s review, conditional read-allow, and publisher-claim safeguards match the checked-in contracts; no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding a publisher listing for mcp.mail-server.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

qodo-free-for-open-source-projects · 2026-10-09T05:48:09Z

PR Summary by Qodo

Add publisher listing and claimant mapping for mcp.mail-server

✨ Enhancement ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Add a v2 publisher listing for the existing mcp.mail-server contribution, documenting its coverage
 limits.
• Propose yunfeizhu’s numeric GitHub ID for publisher-profile management, subject to acceptance on
 canonical main.
• Record public contributor credit and upstream references separately from claim authority; runtime
 policy remains unchanged.

Diagram

graph TD
  A["MCP contribution"] --> B["Publisher listing"] --> C["Listing validation"] --> D{"Accepted on main?"} --> E["Claim eligibility"] --> F["Publisher profile"]

High-Level Assessment

Use the existing v2 listing mechanism: it separates public attribution from reviewed claim authority without changing the native contribution. Leaving the claimant mapping empty would preserve the current inability to claim a profile; adding it to runtime policy would cross the intended metadata boundary.

Files changed (1) +24 / -0

Enhancement (1) +24 / -0

mcp.mail-server.jsonAdd v2 publisher metadata and proposed claimant ID +24/-0

Add v2 publisher metadata and proposed claimant ID

• Adds presentation text describing the existing deletion-review coverage and launch-identity limits, plus public contributor, provenance, and upstream references. Proposes numeric GitHub ID 12027613 in maintainerGithubIds for publisher-profile management, subject to maintainer acceptance on canonical main.

contributions/extension-listings/mcp.mail-server.json

gitar-bot · 2026-10-09T05:48:21Z

Code Review ✅ Approved

🔴 High risk · Adding maintainerGithubIds for mcp.mail-server could authorize publisher-profile claims, allowing an incorrect mapping to grant profile control.

Adds a publisher listing file for the existing mcp.mail-server contribution (contributions/extension-listings/mcp.mail-server.json), proposing yunfeizhu (GitHub ID 12027613) as the authorized publisher-profile manager via maintainerGithubIds, pending maintainer acceptance on main. No issues found.

Review coverage

📋 Rules 2 not applicable

🧪 Functional validation Not enabled · Set up

Options ✅ Auto-apply

✅ Auto-apply is on → Gitar will commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

`✅ Auto-apply`	`Compact`
`gitar auto-apply:off`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

qodo-free-for-open-source-projects · 2026-10-09T05:48:32Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

gitar-bot · 2026-10-09T05:49:07Z

Gitar is not allowed to push to this forked PR. Please enable "Allow edits from maintainers" to allow Gitar to push.

github-actions · 2026-10-09T05:49:17Z

Gitar found a repair, but GitHub did not allow it to push to this fork.

If you want Gitar to apply safe mechanical follow-up fixes:

Enable Allow edits from maintainers on this pull request.
If GitHub instead says Allow edits and access to secrets by maintainers, leave it disabled and apply Gitar's suggestion yourself.
Then comment gitar auto-apply:on to request another Gitar pass.

Only the fork owner can grant maintainer edits. This notice does not change access or request credentials.

yunfeizhu · 2026-10-09T05:51:18Z

@kantorcodes @deep-purple-boots @zerocodefast could you please review this publisher-listing follow-up to #3278 and approve it if the proposed claimant mapping looks correct?

This PR only adds contributions/extension-listings/mcp.mail-server.json, proposing yunfeizhu (numeric GitHub ID 12027613) as the publisher-profile manager. The original contribution is already merged, but the profile cannot be claimed until this mapping is reviewed and accepted on main.

The PR has one commit, and all 109 focused listing/claim-notice tests passed locally. CI is still finishing. Please merge once the review and required checks pass so I can complete the Extension Studio claim. Thanks!

qodo-code-review · 2026-10-09T05:53:52Z

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

github-actions · 2026-10-09T05:55:07Z

Your HOL Guard extension contribution is merged and its publisher page is ready to claim.

Claim your extension

Claim mcp.mail-server in Extension Studio — @yunfeizhu

Open your link and continue with GitHub using an account named above. Claiming creates a public publisher page that credits your GitHub account.

After claiming, Extension Studio lets you shape a launch story, prepare a setup guide and blog content, and use the verified publisher badge toolkit. Submit launch content for review when ready; claiming alone does not publish it.

Claim verification re-reads canonical main and checks the accepted numeric GitHub ID before granting publisher access. The publisher profile is separate from runtime trust, activation, or upstream ownership.

feat(extensions): add mcp-mail-server publisher listing

2f87bc1

yunfeizhu requested review from deep-purple-boots, kantorcodes and zerocodefast as code owners October 9, 2026 05:47

github-actions Bot added the gitar-managed Enables Gitar automatic repair for a pull request label Oct 9, 2026

kantorcodes approved these changes Oct 9, 2026

View reviewed changes

zerocodefast merged commit 4736564 into hashgraph-online:main Oct 9, 2026
59 of 60 checks passed

Navigation Menu

Repository navigation

Add publisher listing for mcp.mail-server - #3805

Add publisher listing for mcp.mail-server#3805
zerocodefast merged 1 commit into
hashgraph-online:mainfrom
yunfeizhu:codex/mcp-mail-server-publisher-listing

yunfeizhu commented Oct 9, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

greptile-apps Bot commented Oct 9, 2026

Uh oh!

coderabbitai Bot commented Oct 9, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 9, 2026

Uh oh!

gitar-bot Bot commented Oct 9, 2026 •

edited

Loading

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 9, 2026

Uh oh!

gitar-bot Bot commented Oct 9, 2026

Uh oh!

github-actions Bot commented Oct 9, 2026

Uh oh!

yunfeizhu commented Oct 9, 2026

Uh oh!

qodo-code-review Bot commented Oct 9, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 9, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

yunfeizhu commented Oct 9, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Upstream source and version

Capability boundary

Fast validation

Checklist

Summary by CodeRabbit

Uh oh!

greptile-apps Bot commented Oct 9, 2026

Uh oh!

coderabbitai Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 9, 2026

PR Summary by Qodo

Uh oh!

gitar-bot Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 9, 2026

Code Review by Qodo

Great, no issues found!

Uh oh!

gitar-bot Bot commented Oct 9, 2026

Uh oh!

github-actions Bot commented Oct 9, 2026

Uh oh!

yunfeizhu commented Oct 9, 2026

Uh oh!

qodo-code-review Bot commented Oct 9, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 9, 2026

Claim your extension

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

yunfeizhu commented Oct 9, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 9, 2026 •

edited

Loading

gitar-bot Bot commented Oct 9, 2026 •

edited

Loading