Rename safe-inputs to mcp-scripts

.github/aw/campaign.md

@@ -109,7 +109,7 @@ KPI workflows are campaigns where the first-class output is a **metric** and an
 **Inputs (when you need knobs):**
 
 - Use `workflow_dispatch` inputs for user-controlled parameters (e.g., target threshold, window size) and have a deterministic `steps:` block normalize those inputs into a JSON config the agent reads.
-- Use `safe-inputs:` when the agent needs a constrained, auditable tool to fetch privileged data (it’s not a human input mechanism).
+- Use `mcp-scripts:` when the agent needs a constrained, auditable tool to fetch privileged data (it’s not a human input mechanism).
 
 **Minimum viable KPI spec (keep it explicit):**
 

.github/aw/runbooks/workflow-health.md

@@ -39,12 +39,12 @@ Use this runbook when:
 ### Input/Secret Validation Failures
 
 **Symptoms**:
-- Safe-inputs action fails
+- MCP Scripts action fails
 - Environment variable not available
 - Template expression evaluation errors
 
 **Common Causes**:
-- Safe-inputs action not configured
+- MCP Scripts action not configured
 - Missing required secrets
 - Incorrect secret references
 
@@ -77,7 +77,7 @@ Missing-tool errors typically appear in this format:
 
 ```
 Error: Tool 'github:read_issue' not found
-Error: missing tool configuration for safeinputs-gh
+Error: missing tool configuration for mcpscripts-gh
 ```
 
 To identify which tools are missing:
@@ -192,27 +192,27 @@ tools:
 Analyze repository issues and provide insights.
 ```
 
-### Configuring Safe-Inputs and Safe-Outputs
+### Configuring MCP Scripts and Safe-Outputs
 
-**Problem**: Workflow fails with missing safeinputs-gh or safe-output errors.
+**Problem**: Workflow fails with missing mcpscripts-gh or safe-output errors.
 
-**Solution**: Configure safe-inputs and safe-outputs in the workflow.
+**Solution**: Configure mcp-scripts and safe-outputs in the workflow.
 
-#### Adding Safe-Inputs
+#### Adding MCP Scripts
 
-Safe-inputs securely pass GitHub context to AI agents:
+MCP Scripts securely pass GitHub context to AI agents:
 
 ```aw
 ---
-safe-inputs:
+mcp-scripts:
   issue:
     title: ${{ github.event.issue.title }}
     body: ${{ github.event.issue.body }}
     number: ${{ github.event.issue.number }}
 ---
 ```
 
-The safe-inputs are automatically made available to the agent as environment variables.
+The mcp-scripts are automatically made available to the agent as environment variables.
 
 #### Adding Safe-Outputs
 
@@ -230,7 +230,7 @@ safe-outputs:
 ---
 ```
 
-**Example**: Complete workflow with safe-inputs and safe-outputs
+**Example**: Complete workflow with mcp-scripts and safe-outputs
 
 ```aw
 ---
@@ -246,7 +246,7 @@ tools:
   github:
     mode: remote
     toolsets: [default]
-safe-inputs:
+mcp-scripts:
   issue:
     title: ${{ github.event.issue.title }}
     body: ${{ github.event.issue.body }}
@@ -303,7 +303,7 @@ The DeepReport Intelligence Briefing (Discussion #7277) identified several workf
 
 1. **Weekly Issue Summary workflow** - Failed in recent runs
 2. **Dev workflow** - Missing GitHub MCP read_issue capability (Run #20435819459)
-3. **Daily Copilot PR Merged workflow** - Missing safeinputs-gh tool
+3. **Daily Copilot PR Merged workflow** - Missing mcpscripts-gh tool
 
 ### Investigation
 
@@ -318,8 +318,8 @@ The DeepReport Intelligence Briefing (Discussion #7277) identified several workf
 - The workflow attempted to read issue information without GitHub MCP toolset
 
 **Daily Copilot PR Merged**:
-- Error: "missing tool configuration for safeinputs-gh"
-- Root cause: Safe-inputs action not set up in workflow
+- Error: "missing tool configuration for mcpscripts-gh"
+- Root cause: MCP Scripts action not set up in workflow
 - PR merge data not being passed securely to agent
 
 ### Resolution
@@ -340,10 +340,10 @@ tools:
 ```
 
 **Daily Copilot PR Merged**:
-Added safe-inputs configuration:
+Added mcp-scripts configuration:
 
 ```aw
-safe-inputs:
+mcp-scripts:
   pull_request:
     number: ${{ github.event.pull_request.number }}
     title: ${{ github.event.pull_request.title }}
@@ -353,7 +353,7 @@ safe-inputs:
 
 1. **MCP-first approach**: Always configure GitHub MCP server when workflows need GitHub API access
 2. **Permission planning**: Define required permissions upfront based on workflow operations
-3. **Safe-inputs for context**: Use safe-inputs to securely pass GitHub event context to agents
+3. **MCP Scripts for context**: Use mcp-scripts to securely pass GitHub event context to agents
 4. **Test after compilation**: Always test workflows manually after making configuration changes
 5. **Monitor systematically**: Use `gh aw logs` for regular workflow health monitoring
 
@@ -396,7 +396,7 @@ tools:
 ---
 ```
 
-**Issue-triggered workflow with safe-inputs**:
+**Issue-triggered workflow with mcp-scripts**:
 ```aw
 ---
 on:
@@ -405,7 +405,7 @@ on:
 permissions:
   contents: read
   issues: write
-safe-inputs:
+mcp-scripts:
   issue:
     title: ${{ github.event.issue.title }}
     body: ${{ github.event.issue.body }}

.github/aw/upgrade-agentic-workflows.md

@@ -102,7 +102,7 @@ Before attempting to compile, apply automatic codemods:
    This will automatically update workflow files with changes like:
    - Replacing 'timeout_minutes' with 'timeout-minutes'
    - Replacing 'network.firewall' with 'sandbox.agent: false'
-   - Removing deprecated 'safe-inputs.mode' field
+   - Removing deprecated 'mcp-scripts.mode' field
 
 2. **Review the Changes**
    - Note which workflows were updated by the codemods

.github/skills/debugging-workflows/SKILL.md

@@ -233,7 +233,7 @@ Use GitHub context like ${{ github.event.issue.number }}.
      ↓
 2. Activation Job
    - Validates permissions
-   - Processes safe-inputs
+   - Processes mcp-scripts
    - Sanitizes context
      ↓
 3. AI Agent Job
@@ -258,7 +258,7 @@ Use GitHub context like ${{ github.event.issue.number }}.
 |-----------|---------|---------------|
 | **Engine** | AI model to use | `engine: copilot`, `claude`, `codex` |
 | **Tools** | APIs available to agent | `tools:` section with MCP servers |
-| **Safe-Inputs** | Context passed to agent | `safe-inputs:` with GitHub expressions |
+| **MCP Scripts** | Context passed to agent | `mcp-scripts:` with GitHub expressions |
 | **Safe-Outputs** | Resources agent can create | `safe-outputs:` with allowed operations |
 | **Permissions** | GitHub token permissions | `permissions:` block |
 | **Network** | Allowed network access | `network:` with domain/ecosystem lists |
@@ -309,16 +309,19 @@ permissions:
 ### Safe-Input Errors
 
 **Symptoms**:
-- "missing tool configuration for safeinputs-gh"
+- "missing tool configuration for mcpscripts-gh"
 - Environment variable not available
 
-**Solution**: Configure safe-inputs:
+**Solution**: Configure mcp-scripts:
 
 ```yaml
-safe-inputs:
+mcp-scripts:
   issue:
-    title: ${{ github.event.issue.title }}
-    body: ${{ github.event.issue.body }}
+    script: |
+      return { title: process.env.ISSUE_TITLE, body: process.env.ISSUE_BODY };
+    env:
+      ISSUE_TITLE: ${{ github.event.issue.title }}
+      ISSUE_BODY: ${{ github.event.issue.body }}
 ```
 
 ### Safe-Output Errors