diff --git a/.github/workflows/go-pattern-detector.lock.yml b/.github/workflows/go-pattern-detector.lock.yml
index de502f4d16d..e8dfb271c5a 100644
--- a/.github/workflows/go-pattern-detector.lock.yml
+++ b/.github/workflows/go-pattern-detector.lock.yml
@@ -652,7 +652,10 @@ jobs:
             "mcpServers": {
               "ast-grep": {
                 "type": "stdio",
-                "container": "mcp/ast-grep:latest"
+                "container": "mcp/ast-grep:latest",
+                "tools": [
+                  "*"
+                ]
               },
               "github": {
                 "container": "ghcr.io/github/github-mcp-server:v0.31.0",
diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml
index cf9b66275bc..51861a4bd5c 100644
--- a/.github/workflows/scout.lock.yml
+++ b/.github/workflows/scout.lock.yml
@@ -808,11 +808,21 @@ jobs:
             "mcpServers": {
               "arxiv": {
                 "type": "stdio",
-                "container": "mcp/arxiv-mcp-server"
+                "container": "mcp/arxiv-mcp-server",
+                "tools": [
+                  "search_arxiv",
+                  "get_paper_details",
+                  "get_paper_pdf"
+                ]
               },
               "deepwiki": {
                 "type": "http",
-                "url": "https://mcp.deepwiki.com/sse"
+                "url": "https://mcp.deepwiki.com/sse",
+                "tools": [
+                  "read_wiki_structure",
+                  "read_wiki_contents",
+                  "ask_question"
+                ]
               },
               "github": {
                 "container": "ghcr.io/github/github-mcp-server:v0.31.0",
@@ -824,11 +834,17 @@ jobs:
               },
               "markitdown": {
                 "type": "stdio",
-                "container": "mcp/markitdown"
+                "container": "mcp/markitdown",
+                "tools": [
+                  "*"
+                ]
               },
               "microsoftdocs": {
                 "type": "http",
-                "url": "https://learn.microsoft.com/api/mcp"
+                "url": "https://learn.microsoft.com/api/mcp",
+                "tools": [
+                  "*"
+                ]
               },
               "safeoutputs": {
                 "type": "http",
@@ -842,7 +858,10 @@ jobs:
                 "url": "https://mcp.tavily.com/mcp/",
                 "headers": {
                   "Authorization": "Bearer ${{ secrets.TAVILY_API_KEY }}"
-                }
+                },
+                "tools": [
+                  "*"
+                ]
               }
             },
             "gateway": {
diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
index 21d3e77b167..80bdc713118 100644
--- a/.github/workflows/smoke-claude.lock.yml
+++ b/.github/workflows/smoke-claude.lock.yml
@@ -2250,7 +2250,10 @@ jobs:
                 "url": "https://mcp.tavily.com/mcp/",
                 "headers": {
                   "Authorization": "Bearer ${{ secrets.TAVILY_API_KEY }}"
-                }
+                },
+                "tools": [
+                  "*"
+                ]
               }
             },
             "gateway": {
diff --git a/pkg/workflow/label_trigger_parser.go b/pkg/workflow/label_trigger_parser.go
index 2f2579568de..832863bd60d 100644
--- a/pkg/workflow/label_trigger_parser.go
+++ b/pkg/workflow/label_trigger_parser.go
@@ -110,7 +110,12 @@ func expandLabelTriggerShorthand(entityType string, labelNames []string) map[str
 	// All event types use `names` field for job condition filtering
 	// The `names` field is an internal representation for job condition generation
 	// and won't be rendered in the final GitHub Actions YAML for these event types
-	triggerConfig["names"] = labelNames
+	// Convert []string to []any so applyLabelFilter can type-assert correctly
+	namesAny := make([]any, len(labelNames))
+	for i, name := range labelNames {
+		namesAny[i] = name
+	}
+	triggerConfig["names"] = namesAny
 
 	// Create workflow_dispatch with item_number input
 	workflowDispatchConfig := map[string]any{
diff --git a/pkg/workflow/label_trigger_parser_fuzz_test.go b/pkg/workflow/label_trigger_parser_fuzz_test.go
index 6684a8980e2..b3985e1dba3 100644
--- a/pkg/workflow/label_trigger_parser_fuzz_test.go
+++ b/pkg/workflow/label_trigger_parser_fuzz_test.go
@@ -141,8 +141,8 @@ func FuzzExpandLabelTriggerShorthand(f *testing.F) {
 					// Check for names field (all event types use names for job condition filtering)
 					if names, hasNames := triggerMap["names"]; !hasNames {
 						t.Errorf("trigger missing names field for entityType=%q", entityType)
-					} else if namesArray, ok := names.([]string); !ok {
-						t.Errorf("names is not a string array for entityType=%q", entityType)
+					} else if namesArray, ok := names.([]any); !ok {
+						t.Errorf("names is not a []any for entityType=%q", entityType)
 					} else if len(namesArray) != len(labelNames) {
 						t.Errorf("names array length mismatch: got %d, want %d for entityType=%q", len(namesArray), len(labelNames), entityType)
 					}
diff --git a/pkg/workflow/label_trigger_parser_test.go b/pkg/workflow/label_trigger_parser_test.go
index e5ca8186470..5f566deeaa2 100644
--- a/pkg/workflow/label_trigger_parser_test.go
+++ b/pkg/workflow/label_trigger_parser_test.go
@@ -379,9 +379,16 @@ func TestExpandLabelTriggerShorthand(t *testing.T) {
 			// Check names field:
 			// All entity types use 'names' field for job condition filtering
 			// (GitHub Actions doesn't support native label filtering)
-			names, ok := triggerConfig["names"].([]string)
+			// names is stored as []any so applyLabelFilter can type-assert correctly
+			namesRaw, ok := triggerConfig["names"].([]any)
 			if !ok {
-				t.Fatalf("expandLabelTriggerShorthand() names is not a string array for %s", tt.entityType)
+				t.Fatalf("expandLabelTriggerShorthand() names is not a []any for %s", tt.entityType)
+			}
+			var names []string
+			for _, n := range namesRaw {
+				if s, isStr := n.(string); isStr {
+					names = append(names, s)
+				}
 			}
 			if !slicesEqual(names, tt.labelNames) {
 				t.Errorf("expandLabelTriggerShorthand() names = %v, want %v", names, tt.labelNames)
diff --git a/pkg/workflow/schedule_preprocessing_test.go b/pkg/workflow/schedule_preprocessing_test.go
index 8b3ff510cfc..ea825c05157 100644
--- a/pkg/workflow/schedule_preprocessing_test.go
+++ b/pkg/workflow/schedule_preprocessing_test.go
@@ -1646,7 +1646,13 @@ func TestLabelTriggerShorthandPreprocessing(t *testing.T) {
 						t.Errorf("expected types=[labeled], got %v", types)
 					}
 					// names must match the expected labels
-					names, _ := triggerMap["names"].([]string)
+					namesRaw, _ := triggerMap["names"].([]any)
+					var names []string
+					for _, n := range namesRaw {
+						if s, isStr := n.(string); isStr {
+							names = append(names, s)
+						}
+					}
 					if !slicesEqual(names, tt.wantLabelNames) {
 						t.Errorf("expected names %v, got %v", tt.wantLabelNames, names)
 					}