Add confirmed repository deletion tool (#3076)

* feat(repos): add confirmed repository deletion

Add a destructive delete_repository tool that requires an exact owner/repo confirmation through multi-round-trip elicitation. Gate the tool to MCP protocol 2026-07-28 and newer across local and remote transports.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* refactor(inventory): generalize tool availability guards

Gate protocol-restricted tools on required elicitation capabilities and enforce direct calls inside the registered handler so SDK result finalization remains intact.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* feat(http): protect MRTR request state

Seal repository deletion targets for self-hosted HTTP with a stable AES-256-GCM key. Hide only delete_repository when no key is configured and expose an optional sealer interface for remote integrators.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* fix(repos): expire deletion confirmations

Bind sealed repository deletion state to the immutable repository ID and a ten-minute expiry. Re-check identity before deletion so replay cannot affect a recreated repository.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* fix(http): preserve tool and scope restrictions

Apply static allowlists before removing unavailable tools and fail closed on invalid configured tool names. Model independent OAuth requirements as conjunctive groups so repository deletion requires both delete_repo and repo.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* fix(repos): require protected confirmation state

Give stdio a process-local request-state sealer and make deletion fail closed without one. Preserve legacy any-of OAuth behavior globally while documenting and enforcing delete_repository's conjunctive delete_repo and repo requirements.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* fix(oauth): request repository deletion scope

Include delete_repo in the supported OAuth scope set used by stdio login, HTTP protected-resource metadata, and tool filtering.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* fix(oauth): require deletion scope opt-in

Keep delete_repo in protected-resource discovery for step-up authorization while excluding it from the default stdio OAuth grant.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* refactor(oauth): derive scope sets from catalog

Generate protected-resource supported scopes and the lower-risk default OAuth grant from one canonical scope definition list.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* refactor(scopes): own OAuth scope catalog

Move supported and default OAuth scope policy into pkg/scopes so protected-resource metadata and stdio grants derive from the scope domain package.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

* fix(scopes): require workflow scope opt-in

Keep workflow and codespace in protected-resource discovery while excluding both from the default OAuth grant alongside delete_repo.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

---------

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

Author: SamMorrowDrums

README.md

@@ -1308,6 +1308,11 @@ The following sets of tools are available:
   - `path`: Path to the file to delete (string, required)
   - `repo`: Repository name (string, required)
 
+- **delete_repository** - Delete repository
+  - **Required OAuth Scopes (all required)**: `delete_repo`, `repo`
+  - `owner`: Repository owner (username or organization) (string, required)
+  - `repo`: Repository name (string, required)
+
 - **fork_repository** - Fork repository
   - **Required OAuth Scopes**: `repo`
   - `organization`: Organization to fork to (string, optional)

cmd/github-mcp-server/generate_docs.go

@@ -221,13 +221,13 @@ func writeToolDoc(buf *strings.Builder, tool inventory.ServerTool) {
 
 	// OAuth scopes if present
 	if len(tool.RequiredScopes) > 0 {
-		// Scope filtering uses "any of" semantics (see scopes.HasRequiredScopes),
-		// so when multiple required scopes are listed, render them as alternatives
-		// rather than implying all are required.
 		scopeList := "`" + strings.Join(tool.RequiredScopes, "`, `") + "`"
-		if len(tool.RequiredScopes) > 1 {
+		switch {
+		case len(tool.RequiredScopeGroups) > 1:
+			fmt.Fprintf(buf, "  - **Required OAuth Scopes (all required)**: %s\n", scopeList)
+		case len(tool.RequiredScopes) > 1:
 			fmt.Fprintf(buf, "  - **Required OAuth Scopes (any of)**: %s\n", scopeList)
-		} else {
+		default:
 			fmt.Fprintf(buf, "  - **Required OAuth Scopes**: %s\n", scopeList)
 		}
 

cmd/github-mcp-server/main.go

@@ -128,11 +128,11 @@ var (
 			}
 
 			// When no static token is provided, log in via OAuth using the given
-			// client. The requested scopes default to the full supported set
-			// (which filters out no tools); an explicit, narrower --oauth-scopes
-			// both narrows the grant and hides tools needing other scopes.
+			// client. The requested scopes default to the standard set; high-risk
+			// scopes such as delete_repo require explicit --oauth-scopes opt-in.
+			// The requested set also filters tools needing other scopes.
 			if token == "" && !appAuthRequested {
-				scopes := ghoauth.SupportedScopes
+				scopes := ghoauth.DefaultScopes
 				if viper.IsSet("oauth-scopes") {
 					if err := viper.UnmarshalKey("oauth-scopes", &scopes); err != nil {
 						return fmt.Errorf("failed to unmarshal oauth-scopes: %w", err)
@@ -217,6 +217,7 @@ var (
 				EnabledFeatures:      enabledFeatures,
 				InsidersMode:         viper.GetBool("insiders"),
 				TrustProxyHeaders:    viper.GetBool("trust-proxy-headers"),
+				MRTRStateKey:         os.Getenv(ghhttp.MRTRStateKeyEnv),
 			}
 
 			return ghhttp.RunHTTPServer(httpConfig)

cmd/github-mcp-server/main_test.go

@@ -3,9 +3,12 @@ package main
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
+	"github.com/github/github-mcp-server/pkg/inventory"
 	"github.com/google/jsonschema-go/jsonschema"
+	"github.com/modelcontextprotocol/go-sdk/mcp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -38,6 +41,40 @@ func TestGitHubAppFlagsAreStdioOnly(t *testing.T) {
 	assert.Nil(t, httpCmd.Flags().Lookup("app-id"))
 }
 
+func TestWriteToolDocScopeSemantics(t *testing.T) {
+	tests := []struct {
+		name string
+		tool inventory.ServerTool
+		want string
+	}{
+		{
+			name: "legacy multi-scope tools use any-of",
+			tool: inventory.ServerTool{
+				Tool:           mcp.Tool{Name: "legacy", Annotations: &mcp.ToolAnnotations{Title: "Legacy"}},
+				RequiredScopes: []string{"repo", "read:org"},
+			},
+			want: "**Required OAuth Scopes (any of)**",
+		},
+		{
+			name: "conjunctive scope groups use all-required",
+			tool: inventory.ServerTool{
+				Tool:                mcp.Tool{Name: "conjunctive", Annotations: &mcp.ToolAnnotations{Title: "Conjunctive"}},
+				RequiredScopes:      []string{"delete_repo", "repo"},
+				RequiredScopeGroups: [][]string{{"delete_repo"}, {"repo"}},
+			},
+			want: "**Required OAuth Scopes (all required)**",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var buf strings.Builder
+			writeToolDoc(&buf, tt.tool)
+			assert.Contains(t, buf.String(), tt.want)
+		})
+	}
+}
+
 func TestSchemaTypeString(t *testing.T) {
 	tests := []struct {
 		name   string

docs/streamable-http.md

@@ -32,6 +32,27 @@ github-mcp-server http --scope-challenge
 
 When `--scope-challenge` is enabled, requests with insufficient scopes receive a `403 Forbidden` response with a `WWW-Authenticate` header indicating the required scopes.
 
+### Repository deletion and request-state encryption
+
+The `delete_repository` tool uses multi-round-trip elicitation and carries its
+confirmed target through client-held request state. To expose this tool in HTTP
+mode, configure a stable 32-byte encryption key encoded with standard Base64:
+
+```bash
+export GITHUB_MCP_SERVER_MRTR_STATE_KEY="$(openssl rand -base64 32 | tr -d '\n')"
+github-mcp-server http
+```
+
+Use the same key on every replica that may handle a retry. Keep it secret and
+stable during deployments; changing it invalidates confirmations already in
+flight. If the variable is absent, `delete_repository` is not exposed by the
+HTTP server. If it is present but malformed, the server refuses to start.
+
+This self-hosted key is independent of keys used by the hosted remote server.
+Integrators can provide their own request-state sealer through the exported
+`github.RequestStateSealer` interface and expose it from their tool dependencies
+through `github.RequestStateSealerProvider` without changing their key format.
+
 ### With OAuth Metadata Discovery
 
 For use behind reverse proxies or with custom domains, expose OAuth metadata endpoints:

internal/ghmcp/oauth.go

@@ -103,14 +103,6 @@ type oauthAuthenticator interface {
 // delayed response from an older prompt from affecting a newer flow.
 const oauthElicitIDPrefix = "github_authorization:"
 
-// protocolVersionNoServerElicitation is the first MCP protocol version that
-// forbids server-initiated JSON-RPC requests (SEP-2322): from this version on
-// the server may not send elicitation/create while serving a request and must
-// instead return an InputRequests map from the tool call (multi round-trip
-// requests). It mirrors the go-sdk's internal constant of the same value, which
-// the SDK does not export.
-const protocolVersionNoServerElicitation = "2026-07-28"
-
 // serverMayInitiateElicitation reports whether the server is permitted to send
 // elicitation requests to the client itself, which the spec allows only before
 // protocol version 2026-07-28. A nil or un-negotiated session (only reached in
@@ -120,7 +112,7 @@ func serverMayInitiateElicitation(ss *mcp.ServerSession) bool {
 		return true
 	}
 	params := ss.InitializeParams()
-	return params == nil || params.ProtocolVersion < protocolVersionNoServerElicitation
+	return params == nil || params.ProtocolVersion < inventory.ProtocolVersionMultiRoundTrip
 }
 
 // createOAuthToolMiddleware returns tool-handler middleware that authorizes the

internal/ghmcp/server.go

@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"github.com/github/github-mcp-server/internal/oauth"
+	"github.com/github/github-mcp-server/internal/requeststate"
 	"github.com/github/github-mcp-server/pkg/errors"
 	"github.com/github/github-mcp-server/pkg/github"
 	"github.com/github/github-mcp-server/pkg/http/transport"
@@ -169,6 +170,10 @@ func NewStdioMCPServer(ctx context.Context, cfg github.MCPServerConfig) (*mcp.Se
 		featureChecker,
 		obs,
 	)
+	deps.StateSealer, err = requeststate.NewRandom()
+	if err != nil {
+		return nil, fmt.Errorf("failed to configure request-state protection: %w", err)
+	}
 	// Build and register the tool/resource/prompt inventory
 	inventoryBuilder := github.NewInventory(cfg.Translator, github.WithHost(hostType)).
 		WithDeprecatedAliases(github.DeprecatedToolAliases).

internal/requeststate/sealer.go

@@ -0,0 +1,81 @@
+package requeststate
+
+import (
+	"context"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"fmt"
+)
+
+const keySize = 32
+
+// Sealer protects request state with AES-256-GCM.
+type Sealer struct {
+	aead cipher.AEAD
+}
+
+// NewRandom constructs a sealer with a process-local random key.
+func NewRandom() (*Sealer, error) {
+	key := make([]byte, keySize)
+	if _, err := rand.Read(key); err != nil {
+		return nil, fmt.Errorf("generating key: %w", err)
+	}
+	return newFromKey(key)
+}
+
+// New constructs a sealer from a standard Base64-encoded 32-byte key.
+func New(encodedKey string) (*Sealer, error) {
+	key, err := base64.StdEncoding.DecodeString(encodedKey)
+	if err != nil {
+		return nil, fmt.Errorf("decoding key: %w", err)
+	}
+	if len(key) != keySize {
+		return nil, fmt.Errorf("decoded key must be %d bytes, got %d", keySize, len(key))
+	}
+	return newFromKey(key)
+}
+
+func newFromKey(key []byte) (*Sealer, error) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, fmt.Errorf("creating cipher: %w", err)
+	}
+	aead, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, fmt.Errorf("creating GCM: %w", err)
+	}
+	return &Sealer{aead: aead}, nil
+}
+
+// Seal encrypts and authenticates plaintext into a URL-safe opaque token.
+func (s *Sealer) Seal(_ context.Context, plaintext []byte) (string, error) {
+	nonce := make([]byte, s.aead.NonceSize())
+	if _, err := rand.Read(nonce); err != nil {
+		return "", fmt.Errorf("generating nonce: %w", err)
+	}
+	sealed := s.aead.Seal(nonce, nonce, plaintext, nil)
+	return base64.RawURLEncoding.EncodeToString(sealed), nil
+}
+
+// Open verifies and decrypts a token produced by Seal.
+func (s *Sealer) Open(token string) ([]byte, error) {
+	if token == "" {
+		return nil, errors.New("empty token")
+	}
+	sealed, err := base64.RawURLEncoding.DecodeString(token)
+	if err != nil {
+		return nil, fmt.Errorf("decoding token: %w", err)
+	}
+	nonceSize := s.aead.NonceSize()
+	if len(sealed) < nonceSize {
+		return nil, errors.New("token is too short")
+	}
+	plaintext, err := s.aead.Open(nil, sealed[:nonceSize], sealed[nonceSize:], nil)
+	if err != nil {
+		return nil, fmt.Errorf("opening token: %w", err)
+	}
+	return plaintext, nil
+}

internal/requeststate/sealer_test.go

@@ -0,0 +1,68 @@
+package requeststate
+
+import (
+	"context"
+	"encoding/base64"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSealer(t *testing.T) {
+	key := base64.StdEncoding.EncodeToString([]byte("0123456789abcdef0123456789abcdef"))
+	sealer, err := New(key)
+	require.NoError(t, err)
+
+	t.Run("round trip", func(t *testing.T) {
+		plaintext := []byte(`{"owner":"octo","repo":"repo"}`)
+		token, err := sealer.Seal(context.Background(), plaintext)
+		require.NoError(t, err)
+		assert.NotContains(t, token, string(plaintext))
+
+		opened, err := sealer.Open(token)
+		require.NoError(t, err)
+		assert.Equal(t, plaintext, opened)
+	})
+
+	t.Run("rejects tampering", func(t *testing.T) {
+		token, err := sealer.Seal(context.Background(), []byte("state"))
+		require.NoError(t, err)
+		replacement := "A"
+		if strings.HasSuffix(token, replacement) {
+			replacement = "B"
+		}
+
+		_, err = sealer.Open(token[:len(token)-1] + replacement)
+		require.Error(t, err)
+	})
+}
+
+func TestNewRandom(t *testing.T) {
+	sealer, err := NewRandom()
+	require.NoError(t, err)
+	token, err := sealer.Seal(context.Background(), []byte("state"))
+	require.NoError(t, err)
+	opened, err := sealer.Open(token)
+	require.NoError(t, err)
+	assert.Equal(t, []byte("state"), opened)
+}
+
+func TestNew(t *testing.T) {
+	tests := []struct {
+		name string
+		key  string
+	}{
+		{name: "empty key"},
+		{name: "invalid Base64", key: "not-base64"},
+		{name: "wrong decoded length", key: base64.StdEncoding.EncodeToString([]byte("too short"))},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := New(tt.key)
+			require.Error(t, err)
+		})
+	}
+}

pkg/github/__toolsnaps__/delete_repository.snap

@@ -0,0 +1,27 @@
+{
+  "annotations": {
+    "destructiveHint": true,
+    "idempotentHint": false,
+    "readOnlyHint": false,
+    "title": "Delete repository"
+  },
+  "description": "Delete a GitHub repository after the user confirms the exact owner/repository name",
+  "inputSchema": {
+    "properties": {
+      "owner": {
+        "description": "Repository owner (username or organization)",
+        "type": "string"
+      },
+      "repo": {
+        "description": "Repository name",
+        "type": "string"
+      }
+    },
+    "required": [
+      "owner",
+      "repo"
+    ],
+    "type": "object"
+  },
+  "name": "delete_repository"
+}