Add daily concurrency analysis workflow for MCP server tools

[Copilot]

Implements automated concurrency safety analysis for the 32 safe-outputs MCP server tools to detect data races and thread-safety violations before they reach production.

Analysis Methodology

• Detection targets: Module-level mutable state, unprotected read-modify-write sequences, TOCTOU bugs, shared resource access without coordination
• Static analysis: Serena MCP server for semantic Go/TypeScript code analysis with data flow tracing
• Selection strategy: Round-robin with priority for recently modified tools, one deep analysis per run
• State management: cache-memory tracks analysis history and prevents redundant work

Issue Generation

Issues created for findings include:

• Severity classification (CRITICAL/HIGH/MEDIUM/LOW)
• Concrete race condition scenarios with timeline examples
• Fix recommendations with before/after code
• Optional Copilot agent session creation for auto-remediation

Example detected pattern:

// ❌ UNSAFE: Module-level mutable state in create_issue.cjs
let issuesToAssignCopilotGlobal = [];  // Shared across concurrent invocations

function getIssuesToAssignCopilot() {
  return issuesToAssignCopilotGlobal;  // Race condition
}

Configuration

• Runs weekdays 9 AM UTC, 45min timeout
• Tools: Serena (go/typescript), cache-memory, github, bash
• Safe-outputs: create-issue (7d expiry, max 5), create-agent-session (max 3)

Original prompt

Create a daily agentic-workflow that performs a deep-dive analysis on each tool exposed in the MCP-server component to ensure it is safe to run concurrently. This agentic-workflow should use Serena and apply best-in-class concurrency checking techniques from software engineering to validate that the tools can run concurrently without data races or data corruption.

Analyze each tool for:

• Use of global state
• Mutable data structures, especially those accessed concurrently
• Mutations that are not protected by appropriate locking or synchronization

When issues are identified, generate clear agentic prompts with recommended fixes and create-issue entries describing the problems. If no problems are found for a given tool, record a no-op result and continue to the next tool.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

This PR introduces an automated daily concurrency analysis workflow that systematically examines MCP server tools for thread-safety issues and race conditions. The workflow uses Serena for semantic code analysis, implements round-robin tool selection with modification-based prioritization, and creates detailed GitHub issues for discovered concurrency problems.

Changes:

• Adds daily scheduled workflow (weekdays 9 AM UTC) for concurrency analysis
• Implements cache-based round-robin scheduling to track analysis progress across tools
• Configures Serena MCP server for Go/TypeScript semantic code analysis with data flow tracing

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/daily-mcp-concurrency-analysis.md	Defines workflow instructions including analysis methodology, issue templates, and step-by-step agent guidance for concurrency safety validation
.github/workflows/daily-mcp-concurrency-analysis.lock.yml	Generated workflow file implementing the MCP concurrency analysis with job orchestration, safe outputs processing, and artifact management

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.