[BUG] GitHub MCP missing release/tag write tools; git push origin <tag> 403's via sandbox proxy

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment

Claude Code on web (claude.ai/code)
Model: claude-opus-4-7[1m]
Repo: WeirDave/WaxFrame-Professional
What's broken — two related capabilities

No create_release MCP tool. The mcp__github__* toolset exposed to this session includes only read operations for releases: list_releases, get_release_by_tag, get_latest_release. There is no create_release, update_release, or delete_release. Means Claude cannot publish a GitHub Release programmatically.
No tag-write MCP tool, and git push origin <tag> is blocked. Available tag tools are list_tags and get_tag (read-only); no create_tag write tool. Falling back to git: git push origin v3.63.195 returns:
error: RPC failed; HTTP 403 curl 22 The requested URL returned error: 403
send-pack: unexpected disconnect while reading sideband packet
fatal: the remote end hung up unexpectedly
The remote URL is the sandbox-local proxy at http://127.0.0.1:<port>/git/WeirDave/WaxFrame-Professional. Note that regular branch pushes (git push origin main) work fine through the same proxy — only tag refs (refs/tags/*) are rejected. Reproducible on every attempt this session (v3.63.189, v3.63.190, v3.63.195 tag pushes all 403'd).

What Should Happen?

Claude should be able to publish a GitHub Release for a commit it just pushed — either via an mcp__github__create_release tool, or by being able to push annotated tags through the sandbox proxy. Currently neither path works in the Claude Code web environment, forcing the user to manually create every release via the GitHub web UI.

Error Messages/Logs

$ git push origin v3.63.195
error: RPC failed; HTTP 403 curl 22 The requested URL returned error: 403
send-pack: unexpected disconnect while reading sideband packet
fatal: the remote end hung up unexpectedly
Everything up-to-date

Steps to Reproduce

Steps to Reproduce (currently has the placeholder example about test.py — that's not yours, that's the form template)

Open a session in Claude Code on web (claude.ai/code) on a GitHub repo.
Make a commit on main and push it (git push origin main) — this works.
Ask Claude to publish a GitHub Release for that commit.
Claude has no create_release MCP tool available.
Claude falls back to git push origin v1.2.3 (annotated tag).
Result: error: RPC failed; HTTP 403 ... refs/tags/* rejected by sandbox proxy.
User has to manually publish via https://github.com/<owner>/<repo>/releases/new.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.167 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other

Additional Information

Reported via the in-chat conversation with claude-opus-4-7[1m] on Claude Code on web. Workaround used: Claude prepares the Release body and provides a releases/new?tag=...&title=... URL; user manually pastes into the GitHub web UI. Functional but breaks the project's "commit + release simultaneously" rule (Anthropic support AI confirmed this is the intended approach for the web environment but flagged that "regression vs. intentional web-only limitation" needs clarification, since user remembers this working in prior sessions).