fix: separate public repo visibility from OAuth scopes

Keep public_repo as a fixed-token visibility capability while requiring repo for per-call OAuth challenges. Challenge only missing scopes for workflow pushes.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: SamMorrowDrums

README.md

@@ -875,7 +875,7 @@ The following sets of tools are available:
 <summary><picture><source media="(prefers-color-scheme: dark)" srcset="pkg/octicons/icons/issue-opened-dark.png"><source media="(prefers-color-scheme: light)" srcset="pkg/octicons/icons/issue-opened-light.png"><img src="pkg/octicons/icons/issue-opened-light.png" width="20" height="20" alt="issue-opened"></picture> Issues</summary>
 
 - **add_issue_comment** - Add comment to issue or pull request
-  - **OAuth Challenge Scopes**: `public_repo`
+  - **OAuth Challenge Scopes**: `repo`
   - `body`: Comment content. Required unless reaction is provided. (string, optional)
   - `comment_id`: The numeric ID of the issue or pull request comment to react to. Use this for reactions to comments; omit it to react to the issue or pull request itself. Cannot be combined with body. (integer, optional)
   - `issue_number`: Issue or pull request number to comment on or react to. (number, required)
@@ -906,7 +906,7 @@ The following sets of tools are available:
   - `repo`: The name of the repository (string, required)
 
 - **issue_write** - Create or update issue/pull request
-  - **OAuth Challenge Scopes**: `public_repo`
+  - **OAuth Challenge Scopes**: `repo`
   - `assignees`: Usernames to assign to this issue (string[], optional)
   - `body`: Issue body content (string, optional)
   - `duplicate_of`: Issue number that this issue is a duplicate of. Required when state_reason is 'duplicate'. (number, optional)
@@ -1154,7 +1154,7 @@ The following sets of tools are available:
   - `repo`: Repository name (string, required)
 
 - **create_pull_request** - Open new pull request
-  - **OAuth Challenge Scopes**: `public_repo`
+  - **OAuth Challenge Scopes**: `repo`
   - `base`: Branch to merge into (string, required)
   - `body`: PR description (string, optional)
   - `draft`: Create as draft PR (boolean, optional)
@@ -1257,7 +1257,7 @@ The following sets of tools are available:
 <summary><picture><source media="(prefers-color-scheme: dark)" srcset="pkg/octicons/icons/repo-dark.png"><source media="(prefers-color-scheme: light)" srcset="pkg/octicons/icons/repo-light.png"><img src="pkg/octicons/icons/repo-light.png" width="20" height="20" alt="repo"></picture> Repositories</summary>
 
 - **create_branch** - Create branch
-  - **OAuth Challenge Scopes**: `public_repo`
+  - **OAuth Challenge Scopes**: `repo`
   - `branch`: Name for new branch (string, required)
   - `from_branch`: Source branch (defaults to repo default) (string, optional)
   - `owner`: Repository owner (string, required)
@@ -1296,7 +1296,7 @@ The following sets of tools are available:
   - `repo`: Repository name (string, required)
 
 - **fork_repository** - Fork repository
-  - **OAuth Challenge Scopes**: `public_repo`
+  - **OAuth Challenge Scopes**: `repo`
   - `organization`: Organization to fork to (string, optional)
   - `owner`: Repository owner (string, required)
   - `repo`: Repository name (string, required)
@@ -1380,7 +1380,7 @@ The following sets of tools are available:
   - `repo`: Repository name (string, required)
 
 - **push_files** - Push files to repository
-  - **OAuth Challenge Scopes**: `public_repo`, `workflow`
+  - **OAuth Challenge Scopes**: `repo`, `workflow`
   - `branch`: Branch to push to (string, required)
   - `files`: Array of file objects to push, each object with path (string) and content (string) (object[], required)
   - `message`: Commit message (string, required)

docs/feature-flags.md

@@ -35,7 +35,7 @@ runtime behavior (such as output formatting) won't appear here.
 ### `remote_mcp_ui_apps`
 
 - **create_pull_request** - Open new pull request
-  - **OAuth Challenge Scopes**: `public_repo`
+  - **OAuth Challenge Scopes**: `repo`
   - **MCP App UI**: `ui://github-mcp-server/pr-write`
   - `base`: Branch to merge into (string, required)
   - `body`: PR description (string, optional)
@@ -52,7 +52,7 @@ runtime behavior (such as output formatting) won't appear here.
   - No parameters required
 
 - **issue_write** - Create or update issue/pull request
-  - **OAuth Challenge Scopes**: `public_repo`
+  - **OAuth Challenge Scopes**: `repo`
   - **MCP App UI**: `ui://github-mcp-server/issue-write`
   - `assignees`: Usernames to assign to this issue (string[], optional)
   - `body`: Issue body content (string, optional)

docs/insiders-features.md

@@ -29,7 +29,7 @@ The list below is generated from the Go source. It covers tool **inventory and s
 ### `remote_mcp_ui_apps`
 
 - **create_pull_request** - Open new pull request
-  - **OAuth Challenge Scopes**: `public_repo`
+  - **OAuth Challenge Scopes**: `repo`
   - **MCP App UI**: `ui://github-mcp-server/pr-write`
   - `base`: Branch to merge into (string, required)
   - `body`: PR description (string, optional)
@@ -46,7 +46,7 @@ The list below is generated from the Go source. It covers tool **inventory and s
   - No parameters required
 
 - **issue_write** - Create or update issue/pull request
-  - **OAuth Challenge Scopes**: `public_repo`
+  - **OAuth Challenge Scopes**: `repo`
   - **MCP App UI**: `ui://github-mcp-server/issue-write`
   - `assignees`: Usernames to assign to this issue (string[], optional)
   - `body`: Issue body content (string, optional)

pkg/github/issues.go

@@ -1403,7 +1403,7 @@ func AddIssueComment(t translations.TranslationHelperFunc) inventory.ServerTool
 				Required: []string{"owner", "repo", "issue_number"},
 			},
 		},
-		scopes.RequireAll(scopes.PublicRepo),
+		publicRepositoryWriteScopeAccess(),
 		func(ctx context.Context, deps ToolDependencies, _ *mcp.CallToolRequest, args map[string]any) (*mcp.CallToolResult, any, error) {
 			owner, err := RequiredParam[string](args, "owner")
 			if err != nil {
@@ -2524,7 +2524,7 @@ Options are:
 				Required: []string{"method", "owner", "repo"},
 			},
 		},
-		scopes.RequireAll(scopes.PublicRepo),
+		publicRepositoryWriteScopeAccess(),
 		func(ctx context.Context, deps ToolDependencies, req *mcp.CallToolRequest, args map[string]any) (*mcp.CallToolResult, any, error) {
 			method, err := RequiredParam[string](args, "method")
 			if err != nil {

pkg/github/public_repo_scopes_test.go

@@ -10,7 +10,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestPublicRepoContributionToolOAuthScopes(t *testing.T) {
+func TestPublicRepoContributionToolScopeAccess(t *testing.T) {
 	t.Parallel()
 
 	tools := []struct {
@@ -26,14 +26,16 @@ func TestPublicRepoContributionToolOAuthScopes(t *testing.T) {
 
 	for _, tt := range tools {
 		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, []string{string(scopes.PublicRepo)}, tt.tool.ScopeAccess.Scopes)
-			assert.Equal(t, []string{string(scopes.PublicRepo)}, tt.tool.ScopeAccess.Challenge(nil, nil))
-			for _, activeScopes := range [][]string{
-				{string(scopes.PublicRepo)},
-				{string(scopes.Repo)},
-			} {
-				assert.Empty(t, tt.tool.ScopeAccess.Challenge(nil, activeScopes))
-			}
+			assert.Equal(t, []string{string(scopes.Repo)}, tt.tool.ScopeAccess.Scopes)
+			require.NotNil(t, tt.tool.ScopeAccess.Visible)
+			assert.False(t, tt.tool.ScopeAccess.Visible(nil))
+			assert.True(t, tt.tool.ScopeAccess.Visible([]string{string(scopes.PublicRepo)}))
+			assert.True(t, tt.tool.ScopeAccess.Visible([]string{string(scopes.Repo)}))
+
+			require.NotNil(t, tt.tool.ScopeAccess.Challenge)
+			assert.Equal(t, []string{string(scopes.Repo)}, tt.tool.ScopeAccess.Challenge(nil, nil))
+			assert.Equal(t, []string{string(scopes.Repo)}, tt.tool.ScopeAccess.Challenge(nil, []string{string(scopes.PublicRepo)}))
+			assert.Empty(t, tt.tool.ScopeAccess.Challenge(nil, []string{string(scopes.Repo)}))
 		})
 	}
 }
@@ -50,13 +52,23 @@ func TestPublicRepoContributionToolsVisibleToPATs(t *testing.T) {
 		AddIssueComment(translations.NullTranslationHelper),
 	}
 
-	for _, tokenScope := range []scopes.Scope{scopes.PublicRepo, scopes.Repo} {
-		t.Run(string(tokenScope), func(t *testing.T) {
-			filter := CreateToolScopeFilter([]string{string(tokenScope)})
+	tests := []struct {
+		name        string
+		tokenScopes []string
+		wantVisible bool
+	}{
+		{name: "no scopes"},
+		{name: "public_repo", tokenScopes: []string{string(scopes.PublicRepo)}, wantVisible: true},
+		{name: "repo", tokenScopes: []string{string(scopes.Repo)}, wantVisible: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			filter := CreateToolScopeFilter(tt.tokenScopes)
 			for i := range tools {
 				included, err := filter(t.Context(), &tools[i])
 				require.NoError(t, err)
-				assert.True(t, included, "%s should be visible", tools[i].Tool.Name)
+				assert.Equal(t, tt.wantVisible, included, tools[i].Tool.Name)
 			}
 		})
 	}
@@ -73,12 +85,19 @@ func TestPushFilesOAuthScopeChallenges(t *testing.T) {
 		"files": []any{map[string]any{"path": ".github/workflows/ci.yml"}},
 	}
 
-	assert.Equal(t, []string{string(scopes.PublicRepo), string(scopes.Workflow)}, tool.ScopeAccess.Scopes)
-	assert.Equal(t, []string{string(scopes.PublicRepo)}, tool.ScopeAccess.Challenge(regularFiles, nil))
-	assert.Equal(t, []string{string(scopes.PublicRepo), string(scopes.Workflow)}, tool.ScopeAccess.Challenge(workflowFiles, nil))
-	assert.Equal(t, []string{string(scopes.PublicRepo), string(scopes.Workflow)}, tool.ScopeAccess.Challenge(workflowFiles, []string{string(scopes.PublicRepo)}))
-	assert.Empty(t, tool.ScopeAccess.Challenge(regularFiles, []string{string(scopes.PublicRepo)}))
+	assert.Equal(t, []string{string(scopes.Repo), string(scopes.Workflow)}, tool.ScopeAccess.Scopes)
+	require.NotNil(t, tool.ScopeAccess.Visible)
+	assert.True(t, tool.ScopeAccess.Visible([]string{string(scopes.PublicRepo)}))
+	assert.True(t, tool.ScopeAccess.Visible([]string{string(scopes.Repo)}))
+
+	assert.Equal(t, []string{string(scopes.Repo)}, tool.ScopeAccess.Challenge(regularFiles, nil))
+	assert.Equal(t, []string{string(scopes.Repo)}, tool.ScopeAccess.Challenge(regularFiles, []string{string(scopes.PublicRepo)}))
 	assert.Empty(t, tool.ScopeAccess.Challenge(regularFiles, []string{string(scopes.Repo)}))
-	assert.Empty(t, tool.ScopeAccess.Challenge(workflowFiles, []string{string(scopes.PublicRepo), string(scopes.Workflow)}))
+
+	assert.Equal(t, []string{string(scopes.Repo), string(scopes.Workflow)}, tool.ScopeAccess.Challenge(workflowFiles, nil))
+	assert.Equal(t, []string{string(scopes.Repo), string(scopes.Workflow)}, tool.ScopeAccess.Challenge(workflowFiles, []string{string(scopes.PublicRepo)}))
+	assert.Equal(t, []string{string(scopes.Workflow)}, tool.ScopeAccess.Challenge(workflowFiles, []string{string(scopes.Repo)}))
+	assert.Equal(t, []string{string(scopes.Repo)}, tool.ScopeAccess.Challenge(workflowFiles, []string{string(scopes.Workflow)}))
+	assert.Equal(t, []string{string(scopes.Repo)}, tool.ScopeAccess.Challenge(workflowFiles, []string{string(scopes.PublicRepo), string(scopes.Workflow)}))
 	assert.Empty(t, tool.ScopeAccess.Challenge(workflowFiles, []string{string(scopes.Repo), string(scopes.Workflow)}))
 }

pkg/github/pullrequests.go

@@ -706,7 +706,7 @@ func CreatePullRequest(t translations.TranslationHelperFunc) inventory.ServerToo
 				Required: []string{"owner", "repo", "title", "head", "base"},
 			},
 		},
-		scopes.RequireAll(scopes.PublicRepo),
+		publicRepositoryWriteScopeAccess(),
 		func(ctx context.Context, deps ToolDependencies, req *mcp.CallToolRequest, args map[string]any) (*mcp.CallToolResult, any, error) {
 			owner, err := RequiredParam[string](args, "owner")
 			if err != nil {

pkg/github/repositories.go

@@ -1229,7 +1229,7 @@ func ForkRepository(t translations.TranslationHelperFunc) inventory.ServerTool {
 				Required: []string{"owner", "repo"},
 			},
 		},
-		scopes.RequireAll(scopes.PublicRepo),
+		publicRepositoryWriteScopeAccess(),
 		func(ctx context.Context, deps ToolDependencies, _ *mcp.CallToolRequest, args map[string]any) (*mcp.CallToolResult, any, error) {
 			owner, err := RequiredParam[string](args, "owner")
 			if err != nil {
@@ -1526,7 +1526,7 @@ func CreateBranch(t translations.TranslationHelperFunc) inventory.ServerTool {
 				Required: []string{"owner", "repo", "branch"},
 			},
 		},
-		scopes.RequireAll(scopes.PublicRepo),
+		publicRepositoryWriteScopeAccess(),
 		func(ctx context.Context, deps ToolDependencies, _ *mcp.CallToolRequest, args map[string]any) (*mcp.CallToolResult, any, error) {
 			owner, err := RequiredParam[string](args, "owner")
 			if err != nil {
@@ -1658,7 +1658,7 @@ func PushFiles(t translations.TranslationHelperFunc) inventory.ServerTool {
 				Required: []string{"owner", "repo", "branch", "files", "message"},
 			},
 		},
-		scopes.RequireAll(scopes.PublicRepo),
+		publicRepositoryWriteScopeAccess(),
 		func(ctx context.Context, deps ToolDependencies, _ *mcp.CallToolRequest, args map[string]any) (*mcp.CallToolResult, any, error) {
 			owner, err := RequiredParam[string](args, "owner")
 			if err != nil {
@@ -1840,7 +1840,7 @@ func PushFiles(t translations.TranslationHelperFunc) inventory.ServerTool {
 		},
 	)
 	tool.ScopeAccess = scopes.DynamicChallenge(
-		[]scopes.Scope{scopes.PublicRepo, scopes.Workflow},
+		[]scopes.Scope{scopes.Repo, scopes.Workflow},
 		tool.ScopeAccess.Visible,
 		workflowScopeChallengeForFiles,
 	)

pkg/github/repository_path.go

@@ -75,8 +75,12 @@ func workflowScopeChallengeForFiles(arguments map[string]any, activeScopes []str
 			containsWorkflow = true
 		}
 	}
-	if containsWorkflow {
-		return scopes.ChallengeAll(activeScopes, scopes.PublicRepo, scopes.Workflow)
+	var challenge []string
+	if !scopes.HasAll(activeScopes, scopes.Repo) {
+		challenge = append(challenge, string(scopes.Repo))
 	}
-	return scopes.ChallengeAll(activeScopes, scopes.PublicRepo)
+	if containsWorkflow && !scopes.HasAll(activeScopes, scopes.Workflow) {
+		challenge = append(challenge, string(scopes.Workflow))
+	}
+	return challenge
 }

pkg/github/repository_path_test.go

@@ -84,7 +84,7 @@ func TestFileWriteWorkflowScopeChallenges(t *testing.T) {
 				map[string]any{"path": "README.md"},
 				map[string]any{"path": ".github/workflows/ci.yml"},
 			}},
-			want: []string{"public_repo", "workflow"},
+			want: []string{"workflow"},
 		},
 		{
 			name: "push validates entries after workflow",

pkg/github/tool_scopes.go

@@ -5,6 +5,14 @@ import (
 	"github.com/github/github-mcp-server/pkg/scopes"
 )
 
+func publicRepositoryWriteScopeAccess() inventory.ScopeAccess {
+	access := scopes.RequireAll(scopes.Repo)
+	access.Visible = func(activeScopes []string) bool {
+		return scopes.HasAll(activeScopes, scopes.PublicRepo)
+	}
+	return access
+}
+
 func repositoryOrOrganizationScopeAccess() inventory.ScopeAccess {
 	return scopes.DynamicChallenge(
 		[]scopes.Scope{scopes.Repo, scopes.ReadOrg},