Clarification on MCP usage/github repos

[mika54321]

So if I have Github MCP added, the documentation states that a github repo url needs whitelisted for redamon to grab:

In the step #2 it says, "..whitelist the repo URL in the soft-guardrail config"

Where is the config exactly? Unless the config is the prompt which is provided right after step2?

@samugit83 Please clarify

[samugit83]

Hey @mika54321, thanks a lot for catching this and flagging it. You were right to question it.

I dug through the code and you've actually found a documentation bug (it's stale from a previous feat). There is no "soft-guardrail config" where you can whitelist a repo URL, and it's not the prompt shown right below step 2 either.
That prompt is just the task you paste into the chat; it has nothing to do with the guardrail.

Here's what's really going on under the hood:

The soft guardrail is an LLM check that runs once at session start, and it only ever looks at the project's configured target (target_domain / target_ips). It never sees the GitHub repo URL, so there's nothing to "whitelist" there.
What actually makes the agent balk at GitHub calls is a scope reminder injected into its prompt telling it to stay on the configured target. Since github.com isn't your target, the agent can refuse to use the GitHub tools.
There is no per-repo allowlist anywhere in the codebase to add the URL to.
So the only real switch is the first option: turn off the "Agent Guardrail" toggle in the project's Agent Behaviour settings (that's what sets AGENT_GUARDRAIL_ENABLED = false). That removes both the startup check and the scope reminder, and the GitHub tools work.

I've already fixed the wiki page to remove the misleading "whitelist the repo URL" line and explain this clearly. Thanks again for the sharp eye.

[mika54321]

Thank you very much for the explanation. It makes sense now!