Sam Morrow
5e0be03d18
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
CodeQL / Analyze (javascript) (push) Has been cancelled
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
Add PKCE and device flow OAuth support for stdio mode, enabling browser-based authentication as an alternative to PATs. Flow priority (security-ordered): 1. PKCE + browser auto-open (native) 2. PKCE + URL elicitation (Docker with bound port) 3. Device flow fallback (more phishable, last resort) Key changes: - internal/oauth: self-contained OAuth manager with PKCE and device flow - internal/buildinfo: build-time OAuth credential injection via ldflags - BearerAuthTransport: added TokenProvider for dynamic token resolution - OAuth middleware intercepts tools/call to trigger lazy authentication - Scope-based tool filtering using existing SupportedScopes - PAT remains optional when OAuth credentials are configured Security: - PKCE S256 prevents code interception - State parameter prevents CSRF - Callback binds to 127.0.0.1 only - URL elicitation for sensitive URLs (never exposed to LLM) - Tokens stored in memory only, never persisted to disk - ReadHeaderTimeout prevents Slowloris on callback server - html/template auto-escaping prevents XSS in callback pages Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
53 lines
2.1 KiB
Modula-2
53 lines
2.1 KiB
Modula-2
module github.com/github/github-mcp-server
|
|
|
|
go 1.24.0
|
|
|
|
require (
|
|
github.com/go-chi/chi/v5 v5.2.5
|
|
github.com/go-viper/mapstructure/v2 v2.5.0
|
|
github.com/google/go-github/v82 v82.0.0
|
|
github.com/google/jsonschema-go v0.4.2
|
|
github.com/josephburnett/jd/v2 v2.4.0
|
|
github.com/lithammer/fuzzysearch v1.1.8
|
|
github.com/microcosm-cc/bluemonday v1.0.27
|
|
github.com/modelcontextprotocol/go-sdk v1.3.1-0.20260220105450-b17143f71798
|
|
github.com/muesli/cache2go v0.0.0-20221011235721-518229cd8021
|
|
github.com/shurcooL/githubv4 v0.0.0-20240727222349-48295856cce7
|
|
github.com/shurcooL/graphql v0.0.0-20230722043721-ed46e5a46466
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/spf13/pflag v1.0.10
|
|
github.com/spf13/viper v1.21.0
|
|
github.com/stretchr/testify v1.11.1
|
|
github.com/yosida95/uritemplate/v3 v3.0.2
|
|
golang.org/x/oauth2 v0.34.0
|
|
)
|
|
|
|
require (
|
|
github.com/aymerick/douceur v0.2.0 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/fsnotify/fsnotify v1.9.0 // indirect
|
|
github.com/go-openapi/jsonpointer v0.21.0 // indirect
|
|
github.com/go-openapi/swag v0.23.0 // indirect
|
|
github.com/google/go-querystring v1.2.0 // indirect
|
|
github.com/gorilla/css v1.0.1 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/josharian/intern v1.0.0 // indirect
|
|
github.com/mailru/easyjson v0.7.7 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/sagikazarmark/locafero v0.11.0 // indirect
|
|
github.com/segmentio/asm v1.1.3 // indirect
|
|
github.com/segmentio/encoding v0.5.3 // indirect
|
|
github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
|
|
github.com/spf13/afero v1.15.0 // indirect
|
|
github.com/spf13/cast v1.10.0 // indirect
|
|
github.com/stretchr/objx v0.5.2 // indirect
|
|
github.com/subosito/gotenv v1.6.0 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
|
golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 // indirect
|
|
golang.org/x/net v0.38.0 // indirect
|
|
golang.org/x/sys v0.40.0 // indirect
|
|
golang.org/x/text v0.28.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|