Skip to content

[backport] OAuth 2.1 core library — PKCE + device flows (upstream main) #10

Closed as not planned
Closed as not planned
[backport] OAuth 2.1 core library — PKCE + device flows (upstream main)#10
Labels
backportBackport from upstreamfeatureNew featureno-opFork already has equivalent functionality

Description

@gastrodon
gastrodon
opened on Jun 27, 2026

Summary

Introduces internal/oauth, a self-contained OAuth 2.1 login library for the stdio server. Provides:

  • Authorization-code + PKCE flow with a local loopback callback server (state/CSRF, XSS-safe result pages)
  • Device-authorization flow as headless/container fallback
  • A Manager that selects the most secure available channel (browser → URL elicitation → last-resort message) and exposes a refreshing TokenSource
  • Both GitHub OAuth Apps and GitHub Apps are supported; expiring GitHub App tokens are refreshed automatically via x/oauth2
  • Prompter interface decouples MCP client interaction from the OAuth flow so tests are runnable without a live session
  • internal/oauth/env.go for detecting headless environments; internal/oauth/callback.go for loopback receiver

Upstream reference

Fork conflict

None. internal/oauth is a new package with no overlap with the fork's project-management additions.

Context

The stdio server previously required a pre-provisioned PAT. This library is the foundation for zero-config OAuth login — users on github.com can authenticate on first tool call without generating a token, removing a significant friction point for new adopters.

Activity

  1. gastrodon
    added
    backportBackport from upstream
    featureNew feature
    on Jun 27, 2026

  2. gastrodon commented on Jun 27, 2026

    @gastrodon
    gastrodon
    on Jun 27, 2026
    Author

    Unified Changelog — upstream main since v1.4.0

    All changes below are unreleased upstream commits on github/github-mcp-server main (post v1.4.0, 2026-06-18 → 2026-06-26). All are present in this fork's codebase; PATCHER.md has not yet been updated.

    Stories

    OAuth 2.1 stdio login (#13 → sub-issues #10 #11 #12)

    Standalone Features

    Issue dependency read/write tools (#14)

    • upstream: main (post v1.4.0)
    • type: feature / standalone
    • description: issue_dependency_read (get_blocked_by / get_blocking) and issue_dependency_write (add / remove × blocked_by / blocking) via GraphQL blockedBy/blocking connections and addBlockedBy/removeBlockedBy mutations. Feature-flagged behind issue_dependencies. Accepts issue numbers, resolves to node IDs in a single aliased query.
    • upstream commits: 067756a (PR Add issue dependency read/write MCP tools github/github-mcp-server#2751)
    • fork conflict: mild design note — the fork's issue_graph traverses sub-issues and cross-refs. Blocked-by/blocking is a complementary axis not yet covered by issue_graph. Standalone tools are additive.

    get_parent method for issue_read (#15)

    • upstream: main (post v1.4.0)
    • type: feature / standalone
    • description: Adds upward parent traversal to issue_read via GraphQL Issue.parent. Returns {"parent": null} for top-level issues. Always-on, mirroring get_sub_issues.
    • upstream commits: 9430064 (PR Add get_parent method to issue_read github/github-mcp-server#2726)
    • fork conflict: none — additive to issues.go, complementary to issue_graph

    Promote issue fields to default, remove legacy issue_write (#16)

    • upstream: main (post v1.4.0)
    • type: feature / standalone (breaking change — removes old write path)
    • description: Removes remote_mcp_issue_fields feature flag; deletes ~572 lines of legacy issue_write methods that pre-dated issue field support. Granular issue_write with issue_fields is now the only write path.
    • upstream commits: a37837 (PR Promote issue fields and deprecate legacy issue write tool  github/github-mcp-server#2696)
    • fork conflict: none — fork does not extend legacy write methods

    Bug Fixes

    Remove show_ui, centralize show/defer decision (#17)

    Fix delete:true on issue fields — REST DELETE fallback (#18)

    Bound ui_get pagination (#19)

    Fix issue_write form gating for labels/assignees/milestone/type (#20)

    Validate required params in add_comment_to_pending_review (#21)

  3. gastrodon commented on Jun 27, 2026

    @gastrodon
    gastrodon
    on Jun 27, 2026
    Author

    No-op. The fork's codebase already contains the full internal/oauth/ package (callback.go, env.go, flow.go, manager.go, oauth.go, prompter.go, templates/) implementing PKCE and device-code flows. All tests in internal/oauth/*_test.go are present. The last_patched field in PATCHER.md has not yet been updated to reflect this — that will happen at cycle close.

  4. gastrodon
    added
    no-opFork already has equivalent functionality
    on Jun 27, 2026
  5. gastrodon
    closed this as not plannedon Jun 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    backportBackport from upstreamfeatureNew featureno-opFork already has equivalent functionality

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions