Skip to content

Set steering-committee and its child teams to triage on servers, inspector and quickstart-resources - #244

Open
PederHP wants to merge 3 commits into
modelcontextprotocol:mainfrom
PederHP:servers-least-privilege
Open

PederHP wants to merge 3 commits into
modelcontextprotocol:mainfrom
PederHP:servers-least-privilege

Conversation

@PederHP

@PederHP PederHP commented Nov 10, 2026 •

Copy link
Copy Markdown
Member

Permissions clean-up for servers, inspector and quickstart-resources, in line with the contributor ladder's "merge privileges for owned areas".

Before: steering-committee has push on all three repositories, and so do its child teams listed in each entry (SDK teams, sdk-maintainers, auth-maintainers, registry-wg, transport-wg and others). Because child teams inherit from their parent, about 126 people in this config have write access or higher on each repository. Most of them have no role in it.

After: Those grants are triage, the same level these teams have on modelcontextprotocol and .github. They can still label, assign, and close issues and pull requests, and anyone can still contribute through a fork. Write access comes from the team that owns each repository, plus the grants this PR leaves alone:

Repository Owning team, unchanged Write or higher, before After
servers reference-servers-maintainers (admin) 127 25
inspector inspector-maintainers (admin) 126 26
quickstart-resources docs-maintainers (push) 126 28

Unchanged on all three: core-maintainers and lead-maintainers (all_repo_admin org role), moderators (maintain), and security-ig (admin; reviewing that grant is already tracked separately, see the README). docs is archived and left as it is.

Impact on current work, from recent pull requests on each repository:

  • servers (last 600, since 2026-06-30): every branch pushed to the repository came from a reference servers maintainer or a bot. All but one merge was made by someone who keeps write access; the exception was a single merge by a docs-maintainers member.
  • inspector (last 400, since 2026-08-20): every in-repo branch and every merge came from someone who keeps write access, or a bot.
  • quickstart-resources (all 223): most merges are by a docs-maintainers member, which is why that team keeps push. Two people lose write access they have used: one in-repo branch from an mcpb-maintainers member and two merges by a ruby-sdk member. Both can keep contributing through forks.

How: In the three entries of src/config/repoAccess.ts, changes push to triage for steering-committee and each listed child team, except docs-maintainers on quickstart-resources. The set of teams listed is unchanged, so the pulumi preview should show only permission updates on repo-servers, repo-inspector and repo-quickstart-resources. Updates the inheritance note in the README to match.

npm run check passes (format, validate, 79 tests).

🤖 Generated with Claude Code

https://claude.ai/code/session_01MqPQYQV9o5rePatonDBsmh

Write access on servers now comes from the teams that own or operate the
repository: reference-servers-maintainers, core-maintainers, moderators
and security-ig. steering-committee and the SDK, working-group and docs
teams nested under it move from push to triage, matching how they are
configured on modelcontextprotocol and .github.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MqPQYQV9o5rePatonDBsmh
@PederHP
PederHP requested a review from a team as a code owner November 10, 2026 19:44
steering-committee and its child teams move from push to triage on
inspector and quickstart-resources as well. inspector-maintainers keeps
admin on inspector, and docs-maintainers keeps push on
quickstart-resources, where its members do most of the merging.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MqPQYQV9o5rePatonDBsmh
@PederHP PederHP changed the title Set steering-committee and its child teams to triage on servers Set steering-committee and its child teams to triage on servers, inspector and quickstart-resources Nov 10, 2026
sarahnovotny added a commit to sarahnovotny/access that referenced this pull request Nov 13, 2026
MAINTAINERS.md names seven SDK maintainers with no entry in users.ts:
mikekistler (C#), kpavlov (Kotlin), pronskiy (PHP), jerome3o (Python),
bolinfest (Rust), and carlpeaslee and mattt (Swift). None of them is in
the corresponding GitHub team today, so unlike the previous commit these
entries grant access rather than only recording it.

Each SDK role carries, through its own team and the sdk-maintainers
parent, admin on its own SDK repository - maintain for csharp-sdk, which
keeps admin in the separate csharp-sdk-admin team - and python-sdk adds
admin on create-python-server. On top of that it inherits whatever
sdk-maintainers and steering-committee hold when this merges. Read from
main at f89698a that is:

  - maintain on maintainer-docs
  - push on docs, inspector, quickstart-resources and servers
  - triage on .github, access and modelcontextprotocol

Open PR modelcontextprotocol#244 moves inspector, quickstart-resources and servers from push
to triage. It touches only repoAccess.ts and README.md, so it does not
conflict with this branch; if it merges first these seven simply inherit
the smaller set and nothing here needs changing.

Triage on modelcontextprotocol does not allow pull request creation, so
this does not widen the set of people who can open one there.

Confirm each person is still an active maintainer of that SDK before
merging. Where a row is stale, the fix is to drop it from MAINTAINERS.md
instead.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
sarahnovotny added a commit to sarahnovotny/access that referenced this pull request Nov 13, 2026
jerome3o-anthropic is a direct member of the steering-committee GitHub
team today but has no users.ts entry. It is the only account in the
organization holding a team membership the config does not declare, so
recording it changes nothing on GitHub: the entry describes access that
is already granted, namely whatever the steering-committee team holds.
Read from main at f89698a that is maintain on maintainer-docs, push on
docs, inspector, quickstart-resources and servers, and triage on .github
and modelcontextprotocol. Open PR modelcontextprotocol#244 moves the middle three to triage;
that changes what the membership is worth, not whether this entry is
correct.

jerome3o (Jerome Swannack) and jerome3o-anthropic are two accounts for
the same person. MAINTAINERS.md names the first under Python SDK, which
the previous commit records; this commit records the second as the
steering-committee member it already is. Whether the work account should
also carry python-sdk, or whether one of the two should be dropped, is a
question for Jerome.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant