Merge branch 'main' into dependabot/npm_and_yarn/ui/npm_and_yarn-1b56638fe1

Author: SamMorrowDrums

README.md

@@ -894,7 +894,7 @@ The following sets of tools are available:
 - **add_issue_comment** - Add comment to issue or pull request
   - **Required OAuth Scopes**: `repo`
   - `body`: Comment content. Required unless reaction is provided. (string, optional)
-  - `comment_id`: The numeric ID of the issue or pull request comment to react to. Use this for reactions to comments; omit it to react to the issue or pull request itself. Cannot be combined with body. (number, optional)
+  - `comment_id`: The numeric ID of the issue or pull request comment to react to. Use this for reactions to comments; omit it to react to the issue or pull request itself. Cannot be combined with body. (integer, optional)
   - `issue_number`: Issue or pull request number to comment on or react to. (number, required)
   - `owner`: Repository owner (string, required)
   - `reaction`: Emoji reaction to add. Required unless body is provided. (string, optional)
@@ -1284,6 +1284,7 @@ The following sets of tools are available:
 
 - **create_or_update_file** - Create or update file
   - **Required OAuth Scopes**: `repo`
+  - `allow_symlink_write`: Set true to update a symbolic link itself; content must be its new target path. (boolean, optional)
   - `branch`: Branch to create/update the file in (string, required)
   - `content`: Content of the file, exactly as it should appear once written. Do not base64-encode it; this server does that before calling the REST API. (string, required)
   - `message`: Commit message (string, required)
@@ -1308,6 +1309,11 @@ The following sets of tools are available:
   - `path`: Path to the file to delete (string, required)
   - `repo`: Repository name (string, required)
 
+- **delete_repository** - Delete repository
+  - **Required OAuth Scopes (all required)**: `delete_repo`, `repo`
+  - `owner`: Repository owner (username or organization) (string, required)
+  - `repo`: Repository name (string, required)
+
 - **fork_repository** - Fork repository
   - **Required OAuth Scopes**: `repo`
   - `organization`: Organization to fork to (string, optional)
@@ -1596,6 +1602,10 @@ docker run -i --rm \
 
 Lockdown mode limits the content that the server will surface from public repositories. When enabled, the server checks whether the author of each item has push access to the repository. Private repositories are unaffected, and collaborators keep full access to their own content.
 
+Lockdown mode is a best-effort content filter intended to reduce the risk of prompt injection from untrusted repository content (issues, pull requests, comments, commits, etc.). It is **not** an authorization boundary: it does not change what the underlying GitHub credential can read or write, and content withheld from a filtered tool response may still be reachable through other tools or direct GitHub API access with the same credential.
+
+As an intentional exception, content authored by a small set of trusted bot accounts (currently `github-actions[bot]` and `copilot`) is always treated as safe, regardless of push access. This avoids filtering routine automation output (e.g. CI-generated commits or comments) that would otherwise be withheld under lockdown mode.
+
 ```bash
 ./github-mcp-server --lockdown-mode
 ```
@@ -1609,12 +1619,17 @@ docker run -i --rm \
   ghcr.io/github/github-mcp-server
 ```
 
+In HTTP mode, this flag (or `GITHUB_LOCKDOWN_MODE`) is an upper bound: the `X-MCP-Lockdown` request header can enable lockdown mode when the operator has not, but it cannot disable lockdown mode the operator has already enabled. See the [Server Configuration Guide](docs/server-configuration.md#lockdown-mode) for details.
+
 The behavior of lockdown mode depends on the tool invoked.
 
 Following tools will return an error when the author lacks the push access:
 
 - `issue_read:get`
 - `pull_request_read:get`
+- `pull_request_read:get_diff`
+- `pull_request_read:get_files`
+- `pull_request_read:get_commits`
 
 Following tools will filter out content from users lacking the push access:
 

cmd/github-mcp-server/generate_docs.go

@@ -221,13 +221,13 @@ func writeToolDoc(buf *strings.Builder, tool inventory.ServerTool) {
 
 	// OAuth scopes if present
 	if len(tool.RequiredScopes) > 0 {
-		// Scope filtering uses "any of" semantics (see scopes.HasRequiredScopes),
-		// so when multiple required scopes are listed, render them as alternatives
-		// rather than implying all are required.
 		scopeList := "`" + strings.Join(tool.RequiredScopes, "`, `") + "`"
-		if len(tool.RequiredScopes) > 1 {
+		switch {
+		case len(tool.RequiredScopeGroups) > 1:
+			fmt.Fprintf(buf, "  - **Required OAuth Scopes (all required)**: %s\n", scopeList)
+		case len(tool.RequiredScopes) > 1:
 			fmt.Fprintf(buf, "  - **Required OAuth Scopes (any of)**: %s\n", scopeList)
-		} else {
+		default:
 			fmt.Fprintf(buf, "  - **Required OAuth Scopes**: %s\n", scopeList)
 		}
 

cmd/github-mcp-server/main.go

@@ -128,11 +128,11 @@ var (
 			}
 
 			// When no static token is provided, log in via OAuth using the given
-			// client. The requested scopes default to the full supported set
-			// (which filters out no tools); an explicit, narrower --oauth-scopes
-			// both narrows the grant and hides tools needing other scopes.
+			// client. The requested scopes default to the standard set; high-risk
+			// scopes such as delete_repo require explicit --oauth-scopes opt-in.
+			// The requested set also filters tools needing other scopes.
 			if token == "" && !appAuthRequested {
-				scopes := ghoauth.SupportedScopes
+				scopes := ghoauth.DefaultScopes
 				if viper.IsSet("oauth-scopes") {
 					if err := viper.UnmarshalKey("oauth-scopes", &scopes); err != nil {
 						return fmt.Errorf("failed to unmarshal oauth-scopes: %w", err)
@@ -217,6 +217,7 @@ var (
 				EnabledFeatures:      enabledFeatures,
 				InsidersMode:         viper.GetBool("insiders"),
 				TrustProxyHeaders:    viper.GetBool("trust-proxy-headers"),
+				MRTRStateKey:         os.Getenv(ghhttp.MRTRStateKeyEnv),
 			}
 
 			return ghhttp.RunHTTPServer(httpConfig)

cmd/github-mcp-server/main_test.go

@@ -3,9 +3,12 @@ package main
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
+	"github.com/github/github-mcp-server/pkg/inventory"
 	"github.com/google/jsonschema-go/jsonschema"
+	"github.com/modelcontextprotocol/go-sdk/mcp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -38,6 +41,40 @@ func TestGitHubAppFlagsAreStdioOnly(t *testing.T) {
 	assert.Nil(t, httpCmd.Flags().Lookup("app-id"))
 }
 
+func TestWriteToolDocScopeSemantics(t *testing.T) {
+	tests := []struct {
+		name string
+		tool inventory.ServerTool
+		want string
+	}{
+		{
+			name: "legacy multi-scope tools use any-of",
+			tool: inventory.ServerTool{
+				Tool:           mcp.Tool{Name: "legacy", Annotations: &mcp.ToolAnnotations{Title: "Legacy"}},
+				RequiredScopes: []string{"repo", "read:org"},
+			},
+			want: "**Required OAuth Scopes (any of)**",
+		},
+		{
+			name: "conjunctive scope groups use all-required",
+			tool: inventory.ServerTool{
+				Tool:                mcp.Tool{Name: "conjunctive", Annotations: &mcp.ToolAnnotations{Title: "Conjunctive"}},
+				RequiredScopes:      []string{"delete_repo", "repo"},
+				RequiredScopeGroups: [][]string{{"delete_repo"}, {"repo"}},
+			},
+			want: "**Required OAuth Scopes (all required)**",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var buf strings.Builder
+			writeToolDoc(&buf, tt.tool)
+			assert.Contains(t, buf.String(), tt.want)
+		})
+	}
+}
+
 func TestSchemaTypeString(t *testing.T) {
 	tests := []struct {
 		name   string

docs/remote-server.md

@@ -67,9 +67,10 @@ The Remote GitHub MCP server has optional headers equivalent to the Local server
 - `X-MCP-Readonly`: Enables only "read" tools.
     - Equivalent to `GITHUB_READ_ONLY` env var for Local server.
     - If this header is empty, "false", "f", "no", "n", "0", or "off" (ignoring whitespace and case), it will be interpreted as false. All other values are interpreted as true.
-- `X-MCP-Lockdown`: Enables lockdown mode, hiding public issue details created by users without push access.
+- `X-MCP-Lockdown`: Enables lockdown mode, hiding public issue details created by users without push access. Lockdown mode is a best-effort content filter, not a security boundary.
     - Equivalent to `GITHUB_LOCKDOWN_MODE` env var for Local server.
     - If this header is empty, "false", "f", "no", "n", "0", or "off" (ignoring whitespace and case), it will be interpreted as false. All other values are interpreted as true.
+    - Server-side lockdown configuration is an upper bound: if the operator has already enabled lockdown mode, this header cannot disable it for a request. The header can only enable (or redundantly re-enable) lockdown mode; it cannot relax lockdown mode below the operator's configuration.
 - `X-MCP-Insiders`: Enables insiders mode for early access to new features.
     - Equivalent to `GITHUB_INSIDERS` env var or `--insiders` flag for Local server.
     - If this header is empty, "false", "f", "no", "n", "0", or "off" (ignoring whitespace and case), it will be interpreted as false. All other values are interpreted as true.

docs/server-configuration.md

@@ -29,6 +29,8 @@ Note: **read-only** mode acts as a strict security filter that takes precedence
 
 Note: **excluded tools** takes precedence over toolsets and individual tools — listed tools are always excluded, even if their toolset is enabled or they are explicitly added via `--tools` / `X-MCP-Tools`.
 
+Note: server-side **lockdown mode** (`--lockdown-mode` / `GITHUB_LOCKDOWN_MODE`) is an upper bound in HTTP mode — once an operator enables it, the `X-MCP-Lockdown` header can no longer disable it for a given request. A request may still use the header to enable lockdown mode for itself when the operator has not already enabled it server-wide, but it can never relax lockdown mode below what the operator configured. Lockdown mode remains a best-effort content filter, not a security boundary.
+
 ---
 
 ## Configuration Examples
@@ -292,6 +294,12 @@ When active, this mode will disable all tools that are not read-only even if the
 
 Lockdown mode ensures the server only surfaces content in public repositories from users with push access to that repository. Private repositories are unaffected, and collaborators retain full access to their own content.
 
+> In HTTP mode, server-side lockdown mode (`--lockdown-mode` / `GITHUB_LOCKDOWN_MODE`) is an upper bound: the `X-MCP-Lockdown` header can enable lockdown mode for a request when the operator has not enabled it server-wide, but it cannot disable lockdown mode the operator has already enabled.
+
+Lockdown mode is a best-effort content filter meant to reduce prompt-injection risk from untrusted repository content; it is not an authorization boundary. It does not restrict what the underlying credential can otherwise read or write, and content withheld from a filtered tool response may still be reachable through other tools or direct GitHub API access with the same credential.
+
+As an intentional exception, content authored by trusted bot accounts (currently `github-actions[bot]` and `copilot`) is always treated as safe, regardless of push access, so routine automation output isn't filtered.
+
 **Example:**
 <table>
 <tr><th>Remote Server</th><th>Local Server</th></tr>

docs/streamable-http.md

@@ -32,6 +32,27 @@ github-mcp-server http --scope-challenge
 
 When `--scope-challenge` is enabled, requests with insufficient scopes receive a `403 Forbidden` response with a `WWW-Authenticate` header indicating the required scopes.
 
+### Repository deletion and request-state encryption
+
+The `delete_repository` tool uses multi-round-trip elicitation and carries its
+confirmed target through client-held request state. To expose this tool in HTTP
+mode, configure a stable 32-byte encryption key encoded with standard Base64:
+
+```bash
+export GITHUB_MCP_SERVER_MRTR_STATE_KEY="$(openssl rand -base64 32 | tr -d '\n')"
+github-mcp-server http
+```
+
+Use the same key on every replica that may handle a retry. Keep it secret and
+stable during deployments; changing it invalidates confirmations already in
+flight. If the variable is absent, `delete_repository` is not exposed by the
+HTTP server. If it is present but malformed, the server refuses to start.
+
+This self-hosted key is independent of keys used by the hosted remote server.
+Integrators can provide their own request-state sealer through the exported
+`github.RequestStateSealer` interface and expose it from their tool dependencies
+through `github.RequestStateSealerProvider` without changing their key format.
+
 ### With OAuth Metadata Discovery
 
 For use behind reverse proxies or with custom domains, expose OAuth metadata endpoints:

internal/ghmcp/oauth.go

@@ -103,14 +103,6 @@ type oauthAuthenticator interface {
 // delayed response from an older prompt from affecting a newer flow.
 const oauthElicitIDPrefix = "github_authorization:"
 
-// protocolVersionNoServerElicitation is the first MCP protocol version that
-// forbids server-initiated JSON-RPC requests (SEP-2322): from this version on
-// the server may not send elicitation/create while serving a request and must
-// instead return an InputRequests map from the tool call (multi round-trip
-// requests). It mirrors the go-sdk's internal constant of the same value, which
-// the SDK does not export.
-const protocolVersionNoServerElicitation = "2026-07-28"
-
 // serverMayInitiateElicitation reports whether the server is permitted to send
 // elicitation requests to the client itself, which the spec allows only before
 // protocol version 2026-07-28. A nil or un-negotiated session (only reached in
@@ -120,7 +112,7 @@ func serverMayInitiateElicitation(ss *mcp.ServerSession) bool {
 		return true
 	}
 	params := ss.InitializeParams()
-	return params == nil || params.ProtocolVersion < protocolVersionNoServerElicitation
+	return params == nil || params.ProtocolVersion < inventory.ProtocolVersionMultiRoundTrip
 }
 
 // createOAuthToolMiddleware returns tool-handler middleware that authorizes the

internal/ghmcp/oauth_test.go

@@ -7,12 +7,12 @@ import (
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"testing"
 
 	"github.com/github/github-mcp-server/internal/oauth"
 	"github.com/github/github-mcp-server/pkg/github"
 	"github.com/github/github-mcp-server/pkg/http/headers"
-	"github.com/github/github-mcp-server/pkg/utils"
 	"github.com/google/jsonschema-go/jsonschema"
 	"github.com/modelcontextprotocol/go-sdk/mcp"
 	"github.com/stretchr/testify/assert"
@@ -23,6 +23,108 @@ func discardLogger() *slog.Logger {
 	return slog.New(slog.NewTextHandler(io.Discard, nil))
 }
 
+func TestCreateGitHubClientsScopesRESTAndRawTokens(t *testing.T) {
+	t.Parallel()
+
+	var foreignAuth string
+	foreign := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		foreignAuth = r.Header.Get(headers.AuthorizationHeader)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer foreign.Close()
+
+	var sourceAuth string
+	source := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		sourceAuth = r.Header.Get(headers.AuthorizationHeader)
+		http.Redirect(w, r, foreign.URL, http.StatusFound)
+	}))
+	defer source.Close()
+
+	tests := []struct {
+		name string
+		cfg  github.MCPServerConfig
+	}{
+		{
+			name: "static token",
+			cfg: github.MCPServerConfig{
+				Version: "test",
+				Token:   "static-token",
+			},
+		},
+		{
+			name: "token provider",
+			cfg: github.MCPServerConfig{
+				Version:       "test",
+				TokenProvider: func() string { return "provider-token" },
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			apiHost := newStaticAPIHostResolver(t, source.URL)
+			clients, err := createGitHubClients(tt.cfg, apiHost)
+			require.NoError(t, err)
+
+			sourceAuth = ""
+			foreignAuth = ""
+			resp, err := clients.rest.Client().Get(source.URL + "/rest")
+			require.NoError(t, err)
+			resp.Body.Close()
+			assert.NotEmpty(t, sourceAuth, "REST request must authenticate to the configured host")
+			assert.Empty(t, foreignAuth, "REST redirect must not authenticate to a foreign host")
+
+			sourceAuth = ""
+			foreignAuth = ""
+			resp, err = clients.raw.GetRawContent(context.Background(), "owner", "repo", "file", nil)
+			require.NoError(t, err)
+			resp.Body.Close()
+			assert.NotEmpty(t, sourceAuth, "raw request must authenticate to the configured host")
+			assert.Empty(t, foreignAuth, "raw redirect must not authenticate to a foreign host")
+		})
+	}
+}
+
+type staticAPIHostResolver struct {
+	restURL    *url.URL
+	graphQLURL *url.URL
+	uploadURL  *url.URL
+	rawURL     *url.URL
+}
+
+func newStaticAPIHostResolver(t *testing.T, endpoint string) staticAPIHostResolver {
+	t.Helper()
+
+	u, err := url.Parse(endpoint)
+	require.NoError(t, err)
+	return staticAPIHostResolver{
+		restURL:    u,
+		graphQLURL: u,
+		uploadURL:  u,
+		rawURL:     u,
+	}
+}
+
+func (r staticAPIHostResolver) BaseRESTURL(context.Context) (*url.URL, error) {
+	return r.restURL, nil
+}
+
+func (r staticAPIHostResolver) GraphqlURL(context.Context) (*url.URL, error) {
+	return r.graphQLURL, nil
+}
+
+func (r staticAPIHostResolver) UploadURL(context.Context) (*url.URL, error) {
+	return r.uploadURL, nil
+}
+
+func (r staticAPIHostResolver) RawURL(context.Context) (*url.URL, error) {
+	return r.rawURL, nil
+}
+
+func (r staticAPIHostResolver) AuthorizationServerURL(context.Context) (*url.URL, error) {
+	return r.restURL, nil
+}
+
 // probeToolName is the name of the throwaway tool the harness registers; its
 // handler runs a probe closure against a sessionPrompter so the adapter can be
 // exercised against a real, fully-negotiated server session from the client side.
@@ -583,8 +685,7 @@ func TestCreateGitHubClientsTokenProvider(t *testing.T) {
 	defer server.Close()
 
 	current := ""
-	apiHost, err := utils.NewAPIHost(server.URL)
-	require.NoError(t, err)
+	apiHost := newStaticAPIHostResolver(t, server.URL)
 
 	clients, err := createGitHubClients(github.MCPServerConfig{
 		Version:       "test",