fix(http): preserve tool and scope restrictions

Apply static allowlists before removing unavailable tools and fail closed on invalid configured tool names. Model independent OAuth requirements as conjunctive groups so repository deletion requires both delete_repo and repo.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

Author: SamMorrowDrums

README.md

@@ -1309,7 +1309,7 @@ The following sets of tools are available:
   - `repo`: Repository name (string, required)
 
 - **delete_repository** - Delete repository
-  - **Required OAuth Scopes**: `delete_repo`
+  - **Required OAuth Scopes (any of)**: `delete_repo`, `repo`
   - `owner`: Repository owner (username or organization) (string, required)
   - `repo`: Repository name (string, required)
 

pkg/github/dependencies.go

@@ -245,6 +245,7 @@ func NewTool[In, Out any](
 	})
 	st.RequiredScopes = scopes.ToStringSlice(requiredScopes...)
 	st.AcceptedScopes = scopes.ExpandScopes(requiredScopes...)
+	st.RequiredScopeGroups = scopes.ExpandScopeGroups(requiredScopes...)
 	return st
 }
 
@@ -268,6 +269,7 @@ func NewToolFromHandler(
 	})
 	st.RequiredScopes = scopes.ToStringSlice(requiredScopes...)
 	st.AcceptedScopes = scopes.ExpandScopes(requiredScopes...)
+	st.RequiredScopeGroups = scopes.ExpandScopeGroups(requiredScopes...)
 	return st
 }
 

pkg/github/repositories.go

@@ -747,7 +747,7 @@ func DeleteRepository(t translations.TranslationHelperFunc) inventory.ServerTool
 				Required: []string{"owner", "repo"},
 			},
 		},
-		[]scopes.Scope{scopes.DeleteRepo},
+		[]scopes.Scope{scopes.DeleteRepo, scopes.Repo},
 		func(ctx context.Context, deps ToolDependencies, req *mcp.CallToolRequest, args map[string]any) (*mcp.CallToolResult, any, error) {
 			owner, err := RequiredParam[string](args, "owner")
 			if err != nil {

pkg/github/repositories_test.go

@@ -3002,7 +3002,8 @@ func Test_DeleteRepository(t *testing.T) {
 	assert.True(t, *tool.Annotations.DestructiveHint)
 	assert.Equal(t, inventory.ProtocolVersionMultiRoundTrip, serverTool.MinimumProtocolVersion)
 	assert.Equal(t, inventory.ElicitationModeForm, serverTool.RequiredElicitationMode)
-	assert.Equal(t, []string{string(scopes.DeleteRepo)}, serverTool.RequiredScopes)
+	assert.ElementsMatch(t, []string{string(scopes.DeleteRepo), string(scopes.Repo)}, serverTool.RequiredScopes)
+	assert.Len(t, serverTool.RequiredScopeGroups, 2)
 
 	t.Run("requests exact repository name through elicitation", func(t *testing.T) {
 		result := invokeDeleteRepository(t, serverTool, NewMockedHTTPClient(), nil)

pkg/github/scope_filter.go

@@ -59,6 +59,9 @@ func CreateToolScopeFilter(tokenScopes []string) inventory.ToolFilter {
 		if tool.Tool.Annotations != nil && tool.Tool.Annotations.ReadOnlyHint && onlyRequiresRepoScopes(tool.AcceptedScopes) {
 			return true, nil
 		}
+		if len(tool.RequiredScopeGroups) > 0 {
+			return scopes.HasRequiredScopeGroups(tokenScopes, tool.RequiredScopeGroups), nil
+		}
 		return scopes.HasRequiredScopes(tokenScopes, tool.AcceptedScopes), nil
 	}
 }

pkg/github/scope_filter_test.go

@@ -58,6 +58,12 @@ func TestCreateToolScopeFilter(t *testing.T) {
 		AcceptedScopes: []string{"repo", "admin:org"},
 	}
 
+	toolConjunctiveScopes := &inventory.ServerTool{
+		Tool:                mcp.Tool{Name: "conjunctive_scope_tool"},
+		AcceptedScopes:      []string{"delete_repo", "repo"},
+		RequiredScopeGroups: [][]string{{"delete_repo"}, {"repo"}},
+	}
+
 	tests := []struct {
 		name        string
 		tokenScopes []string
@@ -130,6 +136,18 @@ func TestCreateToolScopeFilter(t *testing.T) {
 			tool:        toolPublicRepoScope,
 			expected:    true,
 		},
+		{
+			name:        "token must satisfy every required scope group",
+			tokenScopes: []string{"delete_repo"},
+			tool:        toolConjunctiveScopes,
+			expected:    false,
+		},
+		{
+			name:        "token satisfying every required scope group can see tool",
+			tokenScopes: []string{"delete_repo", "repo"},
+			tool:        toolConjunctiveScopes,
+			expected:    true,
+		},
 	}
 
 	for _, tt := range tests {

pkg/http/handler.go

@@ -360,14 +360,17 @@ func buildStaticInventory(cfg *ServerConfig, t translations.TranslationHelperFun
 	}
 	opts := []github.ToolOption{github.WithHost(hostType)}
 	tools := github.AllTools(t, opts...)
-	if cfg.disableDeleteRepository {
-		tools = slices.DeleteFunc(tools, func(tool inventory.ServerTool) bool {
+	filterUnavailable := func(tools []inventory.ServerTool) []inventory.ServerTool {
+		if !cfg.disableDeleteRepository {
+			return tools
+		}
+		return slices.DeleteFunc(tools, func(tool inventory.ServerTool) bool {
 			return tool.Tool.Name == github.DeleteRepositoryToolName
 		})
 	}
 
 	if !hasStaticConfig(cfg) {
-		return tools, github.AllResources(t), github.AllPrompts(t)
+		return filterUnavailable(tools), github.AllResources(t), github.AllPrompts(t)
 	}
 
 	b := inventory.NewBuilder().
@@ -387,13 +390,13 @@ func buildStaticInventory(cfg *ServerConfig, t translations.TranslationHelperFun
 
 	inv, err := b.Build()
 	if err != nil {
-		// Fall back to all tools if there's an error (e.g. unknown tool names).
-		// The error will surface again at per-request time if relevant.
-		return tools, github.AllResources(t), github.AllPrompts(t)
+		// Invalid static tool names must fail closed rather than widening an
+		// explicit allowlist to every tool.
+		return nil, github.AllResources(t), github.AllPrompts(t)
 	}
 
 	ctx := context.Background()
-	return inv.AvailableTools(ctx), inv.AvailableResourceTemplates(ctx), inv.AvailablePrompts(ctx)
+	return filterUnavailable(inv.AvailableTools(ctx)), inv.AvailableResourceTemplates(ctx), inv.AvailablePrompts(ctx)
 }
 
 // InventoryFiltersForRequest applies filters to the inventory builder

pkg/http/handler_test.go

@@ -682,9 +682,7 @@ func TestStaticInventoryFallbackKeepsDeleteRepositoryDisabled(t *testing.T) {
 	}
 	tools, _, _ := buildStaticInventory(cfg, translations.NullTranslationHelper)
 
-	for _, tool := range tools {
-		assert.NotEqual(t, github.DeleteRepositoryToolName, tool.Tool.Name)
-	}
+	assert.Empty(t, tools, "an unavailable explicit allowlist must not widen to other tools")
 }
 
 // TestContentTypeHandling verifies that the MCP StreamableHTTP handler

pkg/inventory/server_tool.go

@@ -97,6 +97,10 @@ type ServerTool struct {
 	// This includes the required scopes plus any higher-level scopes that provide
 	// the necessary permissions due to scope hierarchy.
 	AcceptedScopes []string
+
+	// RequiredScopeGroups contains one group of accepted alternatives for each
+	// independently required OAuth scope. Every group must be satisfied.
+	RequiredScopeGroups [][]string
 }
 
 // IsReadOnly returns true if this tool is marked as read-only via annotations.

pkg/scopes/map.go

@@ -12,6 +12,10 @@ type ToolScopeInfo struct {
 
 	// AcceptedScopes contains all scopes that satisfy the requirements (including parent scopes).
 	AcceptedScopes []string
+
+	// RequiredScopeGroups contains accepted alternatives for each independently
+	// required scope. Every group must be satisfied.
+	RequiredScopeGroups [][]string
 }
 
 // globalToolScopeMap is populated from inventory when SetToolScopeMapFromInventory is called
@@ -59,8 +63,9 @@ func GetToolScopeMapFromInventory(inv *inventory.Inventory) ToolScopeMap {
 		tool := &allTools[i]
 		if len(tool.RequiredScopes) > 0 || len(tool.AcceptedScopes) > 0 {
 			result[tool.Tool.Name] = &ToolScopeInfo{
-				RequiredScopes: tool.RequiredScopes,
-				AcceptedScopes: tool.AcceptedScopes,
+				RequiredScopes:      tool.RequiredScopes,
+				AcceptedScopes:      tool.AcceptedScopes,
+				RequiredScopeGroups: tool.RequiredScopeGroups,
 			}
 		}
 	}
@@ -70,6 +75,9 @@ func GetToolScopeMapFromInventory(inv *inventory.Inventory) ToolScopeMap {
 
 // HasAcceptedScope checks if any of the provided user scopes satisfy the tool's requirements.
 func (t *ToolScopeInfo) HasAcceptedScope(userScopes ...string) bool {
+	if t != nil && len(t.RequiredScopeGroups) > 0 {
+		return HasRequiredScopeGroups(userScopes, t.RequiredScopeGroups)
+	}
 	if t == nil || len(t.AcceptedScopes) == 0 {
 		return true // No scopes required
 	}
@@ -99,6 +107,24 @@ func (t *ToolScopeInfo) MissingScopes(userScopes ...string) []string {
 		userScopeSet[s] = true
 	}
 
+	if len(t.RequiredScopeGroups) > 0 {
+		userScopeSet := expandScopeSet(userScopes)
+		var missing []string
+		for i, group := range t.RequiredScopeGroups {
+			satisfied := false
+			for _, scope := range group {
+				if userScopeSet[scope] {
+					satisfied = true
+					break
+				}
+			}
+			if !satisfied && i < len(t.RequiredScopes) {
+				missing = append(missing, t.RequiredScopes[i])
+			}
+		}
+		return missing
+	}
+
 	// Check if any accepted scope is present
 	hasAccepted := false
 	for _, scope := range t.AcceptedScopes {