fix(oauth): require deletion scope opt-in

Keep delete_repo in protected-resource discovery for step-up authorization while excluding it from the default stdio OAuth grant.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

Author: SamMorrowDrums

cmd/github-mcp-server/main.go

@@ -128,11 +128,11 @@ var (
 			}
 
 			// When no static token is provided, log in via OAuth using the given
-			// client. The requested scopes default to the full supported set
-			// (which filters out no tools); an explicit, narrower --oauth-scopes
-			// both narrows the grant and hides tools needing other scopes.
+			// client. The requested scopes default to the standard set; high-risk
+			// scopes such as delete_repo require explicit --oauth-scopes opt-in.
+			// The requested set also filters tools needing other scopes.
 			if token == "" && !appAuthRequested {
-				scopes := ghoauth.SupportedScopes
+				scopes := ghoauth.DefaultScopes
 				if viper.IsSet("oauth-scopes") {
 					if err := viper.UnmarshalKey("oauth-scopes", &scopes); err != nil {
 						return fmt.Errorf("failed to unmarshal oauth-scopes: %w", err)

pkg/http/oauth/oauth.go

@@ -19,13 +19,26 @@ const (
 	OAuthProtectedResourcePrefix = "/.well-known/oauth-protected-resource"
 )
 
-// SupportedScopes lists every OAuth scope that an MCP tool may require. It is the
-// source of truth in two places: HTTP mode advertises it as scopes_supported in
-// the protected-resource metadata, and stdio OAuth login requests it by default
-// and then filters the exposed tools to the granted scopes. A tool whose required
-// scope is absent here is therefore hidden under default OAuth even though a PAT
-// carrying that scope would expose it, so keep this list in sync with tool scope
-// requirements when scopes change.
+// DefaultScopes are requested by stdio OAuth unless the operator explicitly
+// supplies --oauth-scopes. High-risk scopes such as delete_repo require opt-in.
+var DefaultScopes = []string{
+	"repo",
+	"read:org",
+	"read:user",
+	"user:email",
+	"read:packages",
+	"write:packages",
+	"read:project",
+	"project",
+	"gist",
+	"notifications",
+	"workflow",
+	"codespace",
+}
+
+// SupportedScopes lists every OAuth scope that an MCP tool may require. HTTP
+// protected-resource metadata advertises this full set so clients can step up
+// authorization for tools excluded from the default grant.
 var SupportedScopes = []string{
 	"repo",
 	"delete_repo",

pkg/http/oauth/oauth_test.go

@@ -586,6 +586,12 @@ func TestSupportedScopes(t *testing.T) {
 	assert.Equal(t, expectedScopes, SupportedScopes)
 }
 
+func TestDefaultScopesRequiresExplicitDeleteRepoOptIn(t *testing.T) {
+	assert.Contains(t, SupportedScopes, "delete_repo")
+	assert.NotContains(t, DefaultScopes, "delete_repo")
+	assert.Contains(t, DefaultScopes, "repo")
+}
+
 func TestProtectedResourceResponseFormat(t *testing.T) {
 	t.Parallel()