Mirror the existing pkg/scopes subsystem with a new pkg/permissions
package so this repo is the public source of truth for the fine-grained
permission each MCP tool requires.
- pkg/permissions: typed Permission/Level/Scope, Requirement combinators
(Require/AllOf/AnyOf/And, SatisfiedBy, Permissions), and a generated
catalog (catalog_generated.go) produced from the PUBLIC
github/rest-api-description app-permissions schema via gen.go.
- inventory.ServerTool gains RequiredPermissions + chainable WithPermissions;
zero value means "no gate" (tool always shown).
- pkg/github/permission_filter.go: inventory bridge helpers and a fail-open
CreateToolPermissionFilter (dormant in OSS; no granted source).
- Seed hand-authored requirements for a high-signal subset of tools.
- generate-docs emits a "Required Permissions (fine-grained)" line and a
generated table in new docs/permissions-filtering.md; README + server
configuration link it.
- New list-permissions CLI + script/list-permissions.
Catalog data is exclusively public (names + levels as in the REST docs and
the X-Accepted-GitHub-Permissions header); enterprise permissions excluded.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sam Morrow
4ec3576d86