feat(http): protect MRTR request state

Seal repository deletion targets for self-hosted HTTP with a stable AES-256-GCM key. Hide only delete_repository when no key is configured and expose an optional sealer interface for remote integrators.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

Author: SamMorrowDrums

cmd/github-mcp-server/main.go

@@ -217,6 +217,7 @@ var (
 				EnabledFeatures:      enabledFeatures,
 				InsidersMode:         viper.GetBool("insiders"),
 				TrustProxyHeaders:    viper.GetBool("trust-proxy-headers"),
+				MRTRStateKey:         os.Getenv(ghhttp.MRTRStateKeyEnv),
 			}
 
 			return ghhttp.RunHTTPServer(httpConfig)

docs/streamable-http.md

@@ -32,6 +32,27 @@ github-mcp-server http --scope-challenge
 
 When `--scope-challenge` is enabled, requests with insufficient scopes receive a `403 Forbidden` response with a `WWW-Authenticate` header indicating the required scopes.
 
+### Repository deletion and request-state encryption
+
+The `delete_repository` tool uses multi-round-trip elicitation and carries its
+confirmed target through client-held request state. To expose this tool in HTTP
+mode, configure a stable 32-byte encryption key encoded with standard Base64:
+
+```bash
+export GITHUB_MCP_SERVER_MRTR_STATE_KEY="$(openssl rand -base64 32 | tr -d '\n')"
+github-mcp-server http
+```
+
+Use the same key on every replica that may handle a retry. Keep it secret and
+stable during deployments; changing it invalidates confirmations already in
+flight. If the variable is absent, `delete_repository` is not exposed by the
+HTTP server. If it is present but malformed, the server refuses to start.
+
+This self-hosted key is independent of keys used by the hosted remote server.
+Integrators can provide their own request-state sealer through the exported
+`github.RequestStateSealer` interface and expose it from their tool dependencies
+through `github.RequestStateSealerProvider` without changing their key format.
+
 ### With OAuth Metadata Discovery
 
 For use behind reverse proxies or with custom domains, expose OAuth metadata endpoints:

internal/requeststate/sealer.go

@@ -0,0 +1,68 @@
+package requeststate
+
+import (
+	"context"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"fmt"
+)
+
+const keySize = 32
+
+// Sealer protects request state with AES-256-GCM.
+type Sealer struct {
+	aead cipher.AEAD
+}
+
+// New constructs a sealer from a standard Base64-encoded 32-byte key.
+func New(encodedKey string) (*Sealer, error) {
+	key, err := base64.StdEncoding.DecodeString(encodedKey)
+	if err != nil {
+		return nil, fmt.Errorf("decoding key: %w", err)
+	}
+	if len(key) != keySize {
+		return nil, fmt.Errorf("decoded key must be %d bytes, got %d", keySize, len(key))
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, fmt.Errorf("creating cipher: %w", err)
+	}
+	aead, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, fmt.Errorf("creating GCM: %w", err)
+	}
+	return &Sealer{aead: aead}, nil
+}
+
+// Seal encrypts and authenticates plaintext into a URL-safe opaque token.
+func (s *Sealer) Seal(_ context.Context, plaintext []byte) (string, error) {
+	nonce := make([]byte, s.aead.NonceSize())
+	if _, err := rand.Read(nonce); err != nil {
+		return "", fmt.Errorf("generating nonce: %w", err)
+	}
+	sealed := s.aead.Seal(nonce, nonce, plaintext, nil)
+	return base64.RawURLEncoding.EncodeToString(sealed), nil
+}
+
+// Open verifies and decrypts a token produced by Seal.
+func (s *Sealer) Open(token string) ([]byte, error) {
+	if token == "" {
+		return nil, errors.New("empty token")
+	}
+	sealed, err := base64.RawURLEncoding.DecodeString(token)
+	if err != nil {
+		return nil, fmt.Errorf("decoding token: %w", err)
+	}
+	nonceSize := s.aead.NonceSize()
+	if len(sealed) < nonceSize {
+		return nil, errors.New("token is too short")
+	}
+	plaintext, err := s.aead.Open(nil, sealed[:nonceSize], sealed[nonceSize:], nil)
+	if err != nil {
+		return nil, fmt.Errorf("opening token: %w", err)
+	}
+	return plaintext, nil
+}

internal/requeststate/sealer_test.go

@@ -0,0 +1,58 @@
+package requeststate
+
+import (
+	"context"
+	"encoding/base64"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSealer(t *testing.T) {
+	key := base64.StdEncoding.EncodeToString([]byte("0123456789abcdef0123456789abcdef"))
+	sealer, err := New(key)
+	require.NoError(t, err)
+
+	t.Run("round trip", func(t *testing.T) {
+		plaintext := []byte(`{"owner":"octo","repo":"repo"}`)
+		token, err := sealer.Seal(context.Background(), plaintext)
+		require.NoError(t, err)
+		assert.NotContains(t, token, string(plaintext))
+
+		opened, err := sealer.Open(token)
+		require.NoError(t, err)
+		assert.Equal(t, plaintext, opened)
+	})
+
+	t.Run("rejects tampering", func(t *testing.T) {
+		token, err := sealer.Seal(context.Background(), []byte("state"))
+		require.NoError(t, err)
+		replacement := "A"
+		if strings.HasSuffix(token, replacement) {
+			replacement = "B"
+		}
+
+		_, err = sealer.Open(token[:len(token)-1] + replacement)
+		require.Error(t, err)
+	})
+}
+
+func TestNew(t *testing.T) {
+	tests := []struct {
+		name string
+		key  string
+	}{
+		{name: "empty key"},
+		{name: "invalid Base64", key: "not-base64"},
+		{name: "wrong decoded length", key: base64.StdEncoding.EncodeToString([]byte("too short"))},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := New(tt.key)
+			require.Error(t, err)
+		})
+	}
+}

pkg/github/dependencies.go

@@ -127,6 +127,9 @@ type BaseDeps struct {
 
 	// Observability exporters (includes logger)
 	Obsv observability.Exporters
+
+	// StateSealer protects state sent through multi-round-trip requests.
+	StateSealer RequestStateSealer
 }
 
 // Compile-time assertion to verify that BaseDeps implements the ToolDependencies interface.
@@ -199,6 +202,9 @@ func (d BaseDeps) Metrics(ctx context.Context) metrics.Metrics {
 	return d.Obsv.Metrics(ctx)
 }
 
+// GetRequestStateSealer implements RequestStateSealerProvider.
+func (d BaseDeps) GetRequestStateSealer() RequestStateSealer { return d.StateSealer }
+
 // IsFeatureEnabled checks if a feature flag is enabled.
 // Returns false if the feature checker is nil, flag name is empty, or an error occurs.
 // This allows tools to conditionally change behavior based on feature flags.
@@ -279,6 +285,9 @@ type RequestDeps struct {
 
 	// Observability exporters (includes logger)
 	obsv observability.Exporters
+
+	// StateSealer protects state sent through multi-round-trip requests.
+	StateSealer RequestStateSealer
 }
 
 // NewRequestDeps creates a RequestDeps with the provided clients and configuration.
@@ -334,6 +343,9 @@ func (d *RequestDeps) GetClient(ctx context.Context) (*gogithub.Client, error) {
 	return restClient, nil
 }
 
+// GetRequestStateSealer implements RequestStateSealerProvider.
+func (d *RequestDeps) GetRequestStateSealer() RequestStateSealer { return d.StateSealer }
+
 // GetGQLClient implements ToolDependencies.
 func (d *RequestDeps) GetGQLClient(ctx context.Context) (*githubv4.Client, error) {
 	// extract the token from the context

pkg/github/repositories.go

@@ -705,17 +705,23 @@ func CreateRepository(t translations.TranslationHelperFunc) inventory.ServerTool
 }
 
 const (
+	DeleteRepositoryToolName          = "delete_repository"
 	deleteRepositoryConfirmationID    = "delete_repository_confirmation"
 	deleteRepositoryConfirmationField = "repository_name"
 )
 
+type deleteRepositoryState struct {
+	Owner string `json:"owner"`
+	Repo  string `json:"repo"`
+}
+
 // DeleteRepository creates a tool that deletes a GitHub repository after the
 // user confirms its full name through elicitation.
 func DeleteRepository(t translations.TranslationHelperFunc) inventory.ServerTool {
 	tool := NewTool(
 		ToolsetMetadataRepos,
 		mcp.Tool{
-			Name:        "delete_repository",
+			Name:        DeleteRepositoryToolName,
 			Description: t("TOOL_DELETE_REPOSITORY_DESCRIPTION", "Delete a GitHub repository after the user confirms the exact owner/repository name"),
 			Annotations: &mcp.ToolAnnotations{
 				Title:           t("TOOL_DELETE_REPOSITORY_USER_TITLE", "Delete repository"),
@@ -749,12 +755,24 @@ func DeleteRepository(t translations.TranslationHelperFunc) inventory.ServerTool
 			}
 
 			fullName := owner + "/" + repo
+			sealer := requestStateSealerFromDeps(deps)
 			var responses mcp.InputResponseMap
 			if req != nil && req.Params != nil {
 				responses = req.Params.InputResponses
 			}
 			response, ok := responses[deleteRepositoryConfirmationID]
 			if !ok {
+				var requestState string
+				if sealer != nil {
+					state, err := json.Marshal(deleteRepositoryState{Owner: owner, Repo: repo})
+					if err != nil {
+						return nil, nil, fmt.Errorf("failed to marshal repository deletion state: %w", err)
+					}
+					requestState, err = sealer.Seal(ctx, state)
+					if err != nil {
+						return nil, nil, fmt.Errorf("failed to seal repository deletion state: %w", err)
+					}
+				}
 				return &mcp.CallToolResult{
 					InputRequests: mcp.InputRequestMap{
 						deleteRepositoryConfirmationID: &mcp.ElicitParams{
@@ -773,9 +791,27 @@ func DeleteRepository(t translations.TranslationHelperFunc) inventory.ServerTool
 							},
 						},
 					},
+					RequestState: requestState,
 				}, nil, nil
 			}
 
+			if sealer != nil {
+				if req.Params.RequestState == "" {
+					return utils.NewToolResultError("Repository deletion confirmation state was missing. The repository was not deleted."), nil, nil
+				}
+				stateJSON, err := sealer.Open(req.Params.RequestState)
+				if err != nil {
+					return utils.NewToolResultError("Repository deletion confirmation state was invalid. The repository was not deleted."), nil, nil
+				}
+				var state deleteRepositoryState
+				if err := json.Unmarshal(stateJSON, &state); err != nil {
+					return utils.NewToolResultError("Repository deletion confirmation state was invalid. The repository was not deleted."), nil, nil
+				}
+				if state.Owner != owner || state.Repo != repo {
+					return utils.NewToolResultError("Repository deletion target changed after confirmation was requested. The repository was not deleted."), nil, nil
+				}
+			}
+
 			confirmation, ok := response.(*mcp.ElicitResult)
 			if !ok {
 				return utils.NewToolResultError("Repository deletion confirmation was invalid. The repository was not deleted."), nil, nil

pkg/github/repositories_test.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/github/github-mcp-server/internal/githubv4mock"
+	"github.com/github/github-mcp-server/internal/requeststate"
 	"github.com/github/github-mcp-server/internal/toolsnaps"
 	"github.com/github/github-mcp-server/pkg/inventory"
 	"github.com/github/github-mcp-server/pkg/raw"
@@ -3037,6 +3038,96 @@ func Test_DeleteRepository(t *testing.T) {
 		assert.Contains(t, getTextResult(t, result).Text, "owner/repo was deleted")
 	})
 
+	t.Run("seals and verifies the deletion target", func(t *testing.T) {
+		sealer, err := requeststate.New(base64.StdEncoding.EncodeToString([]byte("0123456789abcdef0123456789abcdef")))
+		require.NoError(t, err)
+		client := NewMockedHTTPClient(
+			WithRequestMatchHandler(
+				DeleteReposByOwnerByRepo,
+				mockResponse(t, http.StatusNoContent, nil),
+			),
+		)
+		deps := BaseDeps{
+			Client:      mustNewGHClient(t, client),
+			StateSealer: sealer,
+		}
+		handler := serverTool.Handler(deps)
+
+		firstRequest := createMCPRequest(map[string]any{"owner": "owner", "repo": "repo"})
+		firstResult, err := handler(ContextWithDeps(context.Background(), deps), &firstRequest)
+		require.NoError(t, err)
+		require.NotEmpty(t, firstResult.RequestState)
+
+		retry := createMCPRequest(map[string]any{"owner": "owner", "repo": "repo"})
+		retry.Params.RequestState = firstResult.RequestState
+		retry.Params.InputResponses = mcp.InputResponseMap{
+			deleteRepositoryConfirmationID: &mcp.ElicitResult{
+				Action: "accept",
+				Content: map[string]any{
+					deleteRepositoryConfirmationField: "owner/repo",
+				},
+			},
+		}
+		result, err := handler(ContextWithDeps(context.Background(), deps), &retry)
+		require.NoError(t, err)
+		require.False(t, result.IsError)
+		assert.Contains(t, getTextResult(t, result).Text, "owner/repo was deleted")
+	})
+
+	t.Run("refuses tampered deletion state", func(t *testing.T) {
+		sealer, err := requeststate.New(base64.StdEncoding.EncodeToString([]byte("0123456789abcdef0123456789abcdef")))
+		require.NoError(t, err)
+		deps := BaseDeps{
+			Client:      mustNewGHClient(t, NewMockedHTTPClient()),
+			StateSealer: sealer,
+		}
+		handler := serverTool.Handler(deps)
+
+		request := createMCPRequest(map[string]any{"owner": "owner", "repo": "repo"})
+		request.Params.RequestState = "tampered"
+		request.Params.InputResponses = mcp.InputResponseMap{
+			deleteRepositoryConfirmationID: &mcp.ElicitResult{
+				Action: "accept",
+				Content: map[string]any{
+					deleteRepositoryConfirmationField: "owner/repo",
+				},
+			},
+		}
+		result, err := handler(ContextWithDeps(context.Background(), deps), &request)
+		require.NoError(t, err)
+		require.True(t, result.IsError)
+		assert.Contains(t, getErrorResult(t, result).Text, "state was invalid")
+	})
+
+	t.Run("refuses a changed deletion target", func(t *testing.T) {
+		sealer, err := requeststate.New(base64.StdEncoding.EncodeToString([]byte("0123456789abcdef0123456789abcdef")))
+		require.NoError(t, err)
+		deps := BaseDeps{
+			Client:      mustNewGHClient(t, NewMockedHTTPClient()),
+			StateSealer: sealer,
+		}
+		handler := serverTool.Handler(deps)
+
+		firstRequest := createMCPRequest(map[string]any{"owner": "owner", "repo": "repo"})
+		firstResult, err := handler(ContextWithDeps(context.Background(), deps), &firstRequest)
+		require.NoError(t, err)
+
+		retry := createMCPRequest(map[string]any{"owner": "owner", "repo": "another"})
+		retry.Params.RequestState = firstResult.RequestState
+		retry.Params.InputResponses = mcp.InputResponseMap{
+			deleteRepositoryConfirmationID: &mcp.ElicitResult{
+				Action: "accept",
+				Content: map[string]any{
+					deleteRepositoryConfirmationField: "owner/repo",
+				},
+			},
+		}
+		result, err := handler(ContextWithDeps(context.Background(), deps), &retry)
+		require.NoError(t, err)
+		require.True(t, result.IsError)
+		assert.Contains(t, getErrorResult(t, result).Text, "target changed")
+	})
+
 	t.Run("completes multi-round-trip elicitation before deleting", func(t *testing.T) {
 		httpClient := NewMockedHTTPClient(
 			WithRequestMatchHandler(