Comment by michaelmior

> The GitHub MCP is definitely at fault. It shouldn't allow any mixed interactions across public and private repos

These are separate tool calls. How could the MCP server know that they interact at all?