Repository navigation
[backport] Wire OAuth 2.1 login into stdio server (upstream main) #11
Description
Summary
Connects the internal/oauth core library to the stdio MCP server:
BearerAuthTransportgains aTokenProviderconsulted per-request, so the lazily-acquired, auto-refreshing OAuth token replaces the pinned static token without rebuilding the HTTP clientRunStdioServerstarts without a token and installs receiving middleware that runs the authorization flow on the first tool call, surfacing the auth URL or device code via elicitation (or a tool-result fallback)- Tool filtering uses the requested OAuth scopes; missing-scope tools are hidden
- A
sessionPrompteradapts the MCP server session tooauth.Prompter, keeping the auth URL off the model's context - New stdio flags:
--oauth-client-id,--oauth-client-secret,--oauth-scopes,--oauth-callback-port - New
internal/ghmcp/oauth.gointegrates the session layer;internal/ghmcp/server.goupdated
Upstream reference
- version: upstream main (post v1.4.0, unreleased)
- commits: github@8ce77e3 (2/4 squashed)
- PR: feat(oauth): wire stdio OAuth 2.1 login into the server (2/4) github/github-mcp-server#2710
Fork conflict
None. internal/ghmcp/server.go additions are additive alongside the fork's existing project-management setup.
Context
Without this wiring, the core OAuth library has no effect. This commit makes OAuth login the default path for stdio users on github.com by intercepting the first MCP tool call.
Depends on
See parent issue (OAuth story).
Activity
gastrodon commentedon Jun 27, 2026
Unified Changelog — upstream main since v1.4.0
All changes below are unreleased upstream commits on
github/github-mcp-servermain (post v1.4.0, 2026-06-18 → 2026-06-26). All are present in this fork's codebase;PATCHER.mdhas not yet been updated.Stories
OAuth 2.1 stdio login (#13 → sub-issues #10 #11 #12)
internal/oauth) with PKCE + device-code flows, wired intoRunStdioServeras a lazy first-call interceptor, with build-time credential injection via ldflags. Users on github.com authenticate via browser; PAT is now optional.Standalone Features
Issue dependency read/write tools (#14)
issue_dependency_readandissue_dependency_writevia GraphQL blockedBy/blocking. Feature-flagged behindissue_dependencies.issue_graph, additiveget_parentforissue_read(#15)Issue.parent.Promote issue fields, remove legacy
issue_write(#16)remote_mcp_issue_fieldsFF; delete ~572 lines of legacy write methods.Bug Fixes
Remove
show_ui, centralize show/defer (#17) — commits: 0503f2f (PR github#2774) — fork conflict: mild (v1.4.0 added show_ui; this removes it; no functional impact on fork's tools)Fix
delete:trueon issue fields (#18) — commits: 29634da (PR github#2755) — fork conflict: noneBound
ui_getpagination (#19) — commits: 63d313a (PR github#2766) — fork conflict: noneFix
issue_writeform gating (#20) — commits: 3c4749d (PR github#2767) — fork conflict: noneValidate required params in
add_comment_to_pending_review(#21) — commits: 5aa8ed3 (PR github#2770) — fork conflict: nonegastrodon commentedon Jun 27, 2026
No-op. The fork already has
internal/ghmcp/oauth.go(OAuth session prompter +RunStdioServermiddleware),pkg/http/transport/bearer.gowithTokenProvidersupport, andcmd/github-mcp-server/main.gowith--oauth-client-id/-secret/-scopes/-callback-portflags (37 oauth references confirmed). All wiring is present.