VS Code remote GitHub MCP server requests delete_repo scope unconditionally on OAuth login, with no way to grant a subset

[aclight]

Describe the bug

When authenticating to the remote GitHub MCP server (https://api.githubcopilot.com/mcp/) through VS Code's built-in GitHub OAuth login flow, the consent screen requests the "Delete repositories" permission (delete_repo scope — ability to delete any adminable repository) as part of a single, all-or-nothing authorization request. There is no way to complete login while declining just that scope; the only options are to accept the full requested scope set or cancel authentication entirely (leaving the server unusable, failing with a 401).

I suspect this is a (hopefully unintentional) result of #3076. Based on the comments in that PR, it seems that in at least some circumstances it is not intended that the MCP tool require delete_repo scope (as long as the MCP tool to delete a repository isn't used, of course).

Affected version

Connected via the remote hosted server, not local Docker, so I can't run the local --version command. From my VS Code mcp.json, the server entry reports:

"url": "https://api.githubcopilot.com/mcp/",
"version": "0.31.0"

VS Code info:

Version: 1.135.0 (user setup)
Commit: 08d4889f9ec4a1685d257b9b95de036c8e1ce1e5
Date: 2026-08-25T14:26:52Z
Electron: 42.8.1
ElectronBuildId: 14906494
Chromium: 148.0.7778.280
Node.js: 24.18.1
V8: 14.8.178.38-electron.0
@github/copilot: 1.0.81-0
@github/copilot-sdk: 1.0.11
OS: Windows_NT x64 10.0.26200

Steps to reproduce the behavior

1. In VS Code, configure the marketplace-installed GitHub MCP server entry (io.github.github/github-mcp-server, type: "http", url: https://api.githubcopilot.com/mcp/), using VS Code's built-in OAuth login (no custom PAT/headers). IIUC this is the default configuration, as I don't recall ever changing it.
2. Start/reconnect the MCP server so it triggers (re)authentication.
3. Click the "Allow" button on this dialog:
   
4. Click Continue on this dialog:
   
5. Panic when you see this page and either click Cancel or close the page:
   
6. Attempt to use the MCP server again.

I have been using this MCP server for a while, and encountered this yesterday after VS Code updated iteself.

Expected vs actual behavior

Expected: Some way to authenticate and use the remote GitHub MCP server in VS Code without granting the ability to delete repositories.

Actual: The consent screen requests delete_repo unconditionally with no option to grant a narrower scope set. Declining leaves the server unauthenticated (401), and there is no PAT-free path that avoids this permission.

Logs

2026-08-27 06:57:15.242 [info] Waiting for server to respond to `initialize` request...
2026-08-27 06:57:16.399 [warning] Error getting token from server metadata: Error: User did not consent to login.
2026-08-27 06:57:16.422 [info] Connection state: Error 401 status sending message to https://api.githubcopilot.com/mcp/: bad request: missing required Authorization header

(Logged after declining the consent prompt requesting delete_repo.)

[dodogeny]

Rough one — going from “not the full delete-anything scope” to “accept delete_repo or you can’t log in at all” with no way to scope it down, and a 401 if you decline, is exactly the kind of change that deserves a warning, not a broken login as the discovery mechanism.

We build Apitella — mostly focused on catching an MCP server’s tools/permissions changing out from under you without notice. This is the OAuth-consent flavor of that rather than our usual case (tool-level safety hints), but it’s the same root issue: a destructive capability got bundled in with zero visibility until something broke. No specific ask, just flagging it as the same category of problem we spend most of our time on.