Skip to content

Derive OAuth authorization server strictly from gh-host in HTTP mode#2530

Closed
Copilot wants to merge 2 commits into
mainfrom
copilot/check-oauth-config-gap
Closed

Derive OAuth authorization server strictly from gh-host in HTTP mode#2530
Copilot wants to merge 2 commits into
mainfrom
copilot/check-oauth-config-gap

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 22, 2026

Summary

This change removes custom OAuth authorization-server overrides and keeps HTTP OAuth metadata bound to the GitHub host resolver. For GHES, setting --gh-host/GITHUB_HOST now remains the single configuration step for correct OAuth authorization server discovery.

Why

Allowing a separate authorization-server override introduced an unnecessary second source of truth and could diverge from host-derived behavior.

What changed

  • Config surface simplification
    • Removed --authorization-server flag and corresponding Viper binding/env plumbing.
  • HTTP server wiring
    • Removed AuthorizationServer from HTTP server config path so OAuth metadata uses host-derived resolution only.
  • Docs alignment
    • Removed documentation references to custom authorization-server overrides.
# Supported configuration path
github-mcp-server http --gh-host https://ghe.example.com

MCP impact

  • No tool or API changes
  • Tool schema or behavior changed
  • New tool added

Prompts tested (tool changes only)

  • N/A (no tool changes)

Security / limits

  • No security or limits impact
  • Auth / permissions considered
  • Data exposure, filtering, or token/size limits considered

Tool renaming

  • I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
    • I have added the new tool aliases in deprecated_tool_aliases.go
  • I am not renaming tools as part of this PR

Note: if you're renaming tools, you must add the tool aliases. For more information on how to do so, please refer to the official docs.

Lint & tests

  • Linted locally with ./script/lint
  • Tested locally with ./script/test

Docs

  • Not needed
  • Updated (README / docs / examples)

Copilot AI changed the title Use host-derived OAuth authorization server in HTTP mode Derive OAuth authorization server strictly from gh-host in HTTP mode May 22, 2026
Copilot AI requested a review from SamMorrowDrums May 22, 2026 20:20
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants