Add confirmed repository deletion tool

README.md

@@ -1308,6 +1308,11 @@ The following sets of tools are available:
   - `path`: Path to the file to delete (string, required)
   - `repo`: Repository name (string, required)
 
+- **delete_repository** - Delete repository
+  - **Required OAuth Scopes (all required)**: `delete_repo`, `repo`
+  - `owner`: Repository owner (username or organization) (string, required)
+  - `repo`: Repository name (string, required)
+
 - **fork_repository** - Fork repository
   - **Required OAuth Scopes**: `repo`
   - `organization`: Organization to fork to (string, optional)

cmd/github-mcp-server/generate_docs.go

@@ -221,13 +221,13 @@ func writeToolDoc(buf *strings.Builder, tool inventory.ServerTool) {
 
 	// OAuth scopes if present
 	if len(tool.RequiredScopes) > 0 {
-		// Scope filtering uses "any of" semantics (see scopes.HasRequiredScopes),
-		// so when multiple required scopes are listed, render them as alternatives
-		// rather than implying all are required.
 		scopeList := "`" + strings.Join(tool.RequiredScopes, "`, `") + "`"
-		if len(tool.RequiredScopes) > 1 {
+		switch {
+		case len(tool.RequiredScopeGroups) > 1:
+			fmt.Fprintf(buf, "  - **Required OAuth Scopes (all required)**: %s\n", scopeList)
+		case len(tool.RequiredScopes) > 1:
 			fmt.Fprintf(buf, "  - **Required OAuth Scopes (any of)**: %s\n", scopeList)
-		} else {
+		default:
 			fmt.Fprintf(buf, "  - **Required OAuth Scopes**: %s\n", scopeList)
 		}
 

cmd/github-mcp-server/main.go

@@ -128,11 +128,11 @@ var (
 			}
 
 			// When no static token is provided, log in via OAuth using the given
-			// client. The requested scopes default to the full supported set
-			// (which filters out no tools); an explicit, narrower --oauth-scopes
-			// both narrows the grant and hides tools needing other scopes.
+			// client. The requested scopes default to the standard set; high-risk
+			// scopes such as delete_repo require explicit --oauth-scopes opt-in.
+			// The requested set also filters tools needing other scopes.
 			if token == "" && !appAuthRequested {
-				scopes := ghoauth.SupportedScopes
+				scopes := ghoauth.DefaultScopes
 				if viper.IsSet("oauth-scopes") {
 					if err := viper.UnmarshalKey("oauth-scopes", &scopes); err != nil {
 						return fmt.Errorf("failed to unmarshal oauth-scopes: %w", err)
@@ -217,6 +217,7 @@ var (
 				EnabledFeatures:      enabledFeatures,
 				InsidersMode:         viper.GetBool("insiders"),
 				TrustProxyHeaders:    viper.GetBool("trust-proxy-headers"),
+				MRTRStateKey:         os.Getenv(ghhttp.MRTRStateKeyEnv),
 			}
 
 			return ghhttp.RunHTTPServer(httpConfig)

cmd/github-mcp-server/main_test.go

@@ -3,9 +3,12 @@ package main
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
+	"github.com/github/github-mcp-server/pkg/inventory"
 	"github.com/google/jsonschema-go/jsonschema"
+	"github.com/modelcontextprotocol/go-sdk/mcp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -38,6 +41,40 @@ func TestGitHubAppFlagsAreStdioOnly(t *testing.T) {
 	assert.Nil(t, httpCmd.Flags().Lookup("app-id"))
 }
 
+func TestWriteToolDocScopeSemantics(t *testing.T) {
+	tests := []struct {
+		name string
+		tool inventory.ServerTool
+		want string
+	}{
+		{
+			name: "legacy multi-scope tools use any-of",
+			tool: inventory.ServerTool{
+				Tool:           mcp.Tool{Name: "legacy", Annotations: &mcp.ToolAnnotations{Title: "Legacy"}},
+				RequiredScopes: []string{"repo", "read:org"},
+			},
+			want: "**Required OAuth Scopes (any of)**",
+		},
+		{
+			name: "conjunctive scope groups use all-required",
+			tool: inventory.ServerTool{
+				Tool:                mcp.Tool{Name: "conjunctive", Annotations: &mcp.ToolAnnotations{Title: "Conjunctive"}},
+				RequiredScopes:      []string{"delete_repo", "repo"},
+				RequiredScopeGroups: [][]string{{"delete_repo"}, {"repo"}},
+			},
+			want: "**Required OAuth Scopes (all required)**",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var buf strings.Builder
+			writeToolDoc(&buf, tt.tool)
+			assert.Contains(t, buf.String(), tt.want)
+		})
+	}
+}
+
 func TestSchemaTypeString(t *testing.T) {
 	tests := []struct {
 		name   string

docs/streamable-http.md

@@ -32,6 +32,27 @@ github-mcp-server http --scope-challenge
 
 When `--scope-challenge` is enabled, requests with insufficient scopes receive a `403 Forbidden` response with a `WWW-Authenticate` header indicating the required scopes.
 
+### Repository deletion and request-state encryption
+
+The `delete_repository` tool uses multi-round-trip elicitation and carries its
+confirmed target through client-held request state. To expose this tool in HTTP
+mode, configure a stable 32-byte encryption key encoded with standard Base64:
+
+```bash
+export GITHUB_MCP_SERVER_MRTR_STATE_KEY="$(openssl rand -base64 32 | tr -d '\n')"
+github-mcp-server http
+```
+
+Use the same key on every replica that may handle a retry. Keep it secret and
+stable during deployments; changing it invalidates confirmations already in
+flight. If the variable is absent, `delete_repository` is not exposed by the
+HTTP server. If it is present but malformed, the server refuses to start.
+
+This self-hosted key is independent of keys used by the hosted remote server.
+Integrators can provide their own request-state sealer through the exported
+`github.RequestStateSealer` interface and expose it from their tool dependencies
+through `github.RequestStateSealerProvider` without changing their key format.
+
 ### With OAuth Metadata Discovery
 
 For use behind reverse proxies or with custom domains, expose OAuth metadata endpoints:

internal/ghmcp/oauth.go

@@ -103,14 +103,6 @@ type oauthAuthenticator interface {
 // delayed response from an older prompt from affecting a newer flow.
 const oauthElicitIDPrefix = "github_authorization:"
 
-// protocolVersionNoServerElicitation is the first MCP protocol version that
-// forbids server-initiated JSON-RPC requests (SEP-2322): from this version on
-// the server may not send elicitation/create while serving a request and must
-// instead return an InputRequests map from the tool call (multi round-trip
-// requests). It mirrors the go-sdk's internal constant of the same value, which
-// the SDK does not export.
-const protocolVersionNoServerElicitation = "2026-07-28"
-
 // serverMayInitiateElicitation reports whether the server is permitted to send
 // elicitation requests to the client itself, which the spec allows only before
 // protocol version 2026-07-28. A nil or un-negotiated session (only reached in
@@ -120,7 +112,7 @@ func serverMayInitiateElicitation(ss *mcp.ServerSession) bool {
 		return true
 	}
 	params := ss.InitializeParams()
-	return params == nil || params.ProtocolVersion < protocolVersionNoServerElicitation
+	return params == nil || params.ProtocolVersion < inventory.ProtocolVersionMultiRoundTrip
 }
 
 // createOAuthToolMiddleware returns tool-handler middleware that authorizes the

internal/ghmcp/server.go

@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"github.com/github/github-mcp-server/internal/oauth"
+	"github.com/github/github-mcp-server/internal/requeststate"
 	"github.com/github/github-mcp-server/pkg/errors"
 	"github.com/github/github-mcp-server/pkg/github"
 	"github.com/github/github-mcp-server/pkg/http/transport"
@@ -169,6 +170,10 @@ func NewStdioMCPServer(ctx context.Context, cfg github.MCPServerConfig) (*mcp.Se
 		featureChecker,
 		obs,
 	)
+	deps.StateSealer, err = requeststate.NewRandom()
+	if err != nil {
+		return nil, fmt.Errorf("failed to configure request-state protection: %w", err)
+	}
 	// Build and register the tool/resource/prompt inventory
 	inventoryBuilder := github.NewInventory(cfg.Translator, github.WithHost(hostType)).
 		WithDeprecatedAliases(github.DeprecatedToolAliases).

internal/requeststate/sealer.go

@@ -0,0 +1,81 @@
+package requeststate
+
+import (
+	"context"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"fmt"
+)
+
+const keySize = 32
+
+// Sealer protects request state with AES-256-GCM.
+type Sealer struct {
+	aead cipher.AEAD
+}
+
+// NewRandom constructs a sealer with a process-local random key.
+func NewRandom() (*Sealer, error) {
+	key := make([]byte, keySize)
+	if _, err := rand.Read(key); err != nil {
+		return nil, fmt.Errorf("generating key: %w", err)
+	}
+	return newFromKey(key)
+}
+
+// New constructs a sealer from a standard Base64-encoded 32-byte key.
+func New(encodedKey string) (*Sealer, error) {
+	key, err := base64.StdEncoding.DecodeString(encodedKey)
+	if err != nil {
+		return nil, fmt.Errorf("decoding key: %w", err)
+	}
+	if len(key) != keySize {
+		return nil, fmt.Errorf("decoded key must be %d bytes, got %d", keySize, len(key))
+	}
+	return newFromKey(key)
+}
+
+func newFromKey(key []byte) (*Sealer, error) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, fmt.Errorf("creating cipher: %w", err)
+	}
+	aead, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, fmt.Errorf("creating GCM: %w", err)
+	}
+	return &Sealer{aead: aead}, nil
+}
+
+// Seal encrypts and authenticates plaintext into a URL-safe opaque token.
+func (s *Sealer) Seal(_ context.Context, plaintext []byte) (string, error) {
+	nonce := make([]byte, s.aead.NonceSize())
+	if _, err := rand.Read(nonce); err != nil {
+		return "", fmt.Errorf("generating nonce: %w", err)
+	}
+	sealed := s.aead.Seal(nonce, nonce, plaintext, nil)
+	return base64.RawURLEncoding.EncodeToString(sealed), nil
+}
+
+// Open verifies and decrypts a token produced by Seal.
+func (s *Sealer) Open(token string) ([]byte, error) {
+	if token == "" {
+		return nil, errors.New("empty token")
+	}
+	sealed, err := base64.RawURLEncoding.DecodeString(token)
+	if err != nil {
+		return nil, fmt.Errorf("decoding token: %w", err)
+	}
+	nonceSize := s.aead.NonceSize()
+	if len(sealed) < nonceSize {
+		return nil, errors.New("token is too short")
+	}
+	plaintext, err := s.aead.Open(nil, sealed[:nonceSize], sealed[nonceSize:], nil)
+	if err != nil {
+		return nil, fmt.Errorf("opening token: %w", err)
+	}
+	return plaintext, nil
+}

internal/requeststate/sealer_test.go

@@ -0,0 +1,68 @@
+package requeststate
+
+import (
+	"context"
+	"encoding/base64"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSealer(t *testing.T) {
+	key := base64.StdEncoding.EncodeToString([]byte("0123456789abcdef0123456789abcdef"))
+	sealer, err := New(key)
+	require.NoError(t, err)
+
+	t.Run("round trip", func(t *testing.T) {
+		plaintext := []byte(`{"owner":"octo","repo":"repo"}`)
+		token, err := sealer.Seal(context.Background(), plaintext)
+		require.NoError(t, err)
+		assert.NotContains(t, token, string(plaintext))
+
+		opened, err := sealer.Open(token)
+		require.NoError(t, err)
+		assert.Equal(t, plaintext, opened)
+	})
+
+	t.Run("rejects tampering", func(t *testing.T) {
+		token, err := sealer.Seal(context.Background(), []byte("state"))
+		require.NoError(t, err)
+		replacement := "A"
+		if strings.HasSuffix(token, replacement) {
+			replacement = "B"
+		}
+
+		_, err = sealer.Open(token[:len(token)-1] + replacement)
+		require.Error(t, err)
+	})
+}
+
+func TestNewRandom(t *testing.T) {
+	sealer, err := NewRandom()
+	require.NoError(t, err)
+	token, err := sealer.Seal(context.Background(), []byte("state"))
+	require.NoError(t, err)
+	opened, err := sealer.Open(token)
+	require.NoError(t, err)
+	assert.Equal(t, []byte("state"), opened)
+}
+
+func TestNew(t *testing.T) {
+	tests := []struct {
+		name string
+		key  string
+	}{
+		{name: "empty key"},
+		{name: "invalid Base64", key: "not-base64"},
+		{name: "wrong decoded length", key: base64.StdEncoding.EncodeToString([]byte("too short"))},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := New(tt.key)
+			require.Error(t, err)
+		})
+	}
+}

pkg/github/__toolsnaps__/delete_repository.snap

@@ -0,0 +1,27 @@
+{
+  "annotations": {
+    "destructiveHint": true,
+    "idempotentHint": false,
+    "readOnlyHint": false,
+    "title": "Delete repository"
+  },
+  "description": "Delete a GitHub repository after the user confirms the exact owner/repository name",
+  "inputSchema": {
+    "properties": {
+      "owner": {
+        "description": "Repository owner (username or organization)",
+        "type": "string"
+      },
+      "repo": {
+        "description": "Repository name",
+        "type": "string"
+      }
+    },
+    "required": [
+      "owner",
+      "repo"
+    ],
+    "type": "object"
+  },
+  "name": "delete_repository"
+}

pkg/github/dependencies.go

@@ -127,6 +127,9 @@ type BaseDeps struct {
 
 	// Observability exporters (includes logger)
 	Obsv observability.Exporters
+
+	// StateSealer protects state sent through multi-round-trip requests.
+	StateSealer RequestStateSealer
 }
 
 // Compile-time assertion to verify that BaseDeps implements the ToolDependencies interface.
@@ -199,6 +202,9 @@ func (d BaseDeps) Metrics(ctx context.Context) metrics.Metrics {
 	return d.Obsv.Metrics(ctx)
 }
 
+// GetRequestStateSealer implements RequestStateSealerProvider.
+func (d BaseDeps) GetRequestStateSealer() RequestStateSealer { return d.StateSealer }
+
 // IsFeatureEnabled checks if a feature flag is enabled.
 // Returns false if the feature checker is nil, flag name is empty, or an error occurs.
 // This allows tools to conditionally change behavior based on feature flags.
@@ -279,6 +285,9 @@ type RequestDeps struct {
 
 	// Observability exporters (includes logger)
 	obsv observability.Exporters
+
+	// StateSealer protects state sent through multi-round-trip requests.
+	StateSealer RequestStateSealer
 }
 
 // NewRequestDeps creates a RequestDeps with the provided clients and configuration.
@@ -334,6 +343,9 @@ func (d *RequestDeps) GetClient(ctx context.Context) (*gogithub.Client, error) {
 	return restClient, nil
 }
 
+// GetRequestStateSealer implements RequestStateSealerProvider.
+func (d *RequestDeps) GetRequestStateSealer() RequestStateSealer { return d.StateSealer }
+
 // GetGQLClient implements ToolDependencies.
 func (d *RequestDeps) GetGQLClient(ctx context.Context) (*githubv4.Client, error) {
 	// extract the token from the context