refactor(auth): isolate GitHub App auth to stdio startup

Keep PEM loading and installation-token provider construction at the CLI leaf, then pass a generic refreshing token provider through the existing HTTP transports. Rebase the feature onto current main and keep the HTTP command unchanged.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 646357dd-c89f-4973-9a5c-e6c5fc18818c

Author: SamMorrowDrums

README.md

@@ -311,7 +311,7 @@ Add one of the following JSON blocks to your IDE's MCP settings.
 
 See **[Local Server OAuth Login](docs/oauth-login.md)** for the native-binary flow (no fixed port needed), the headless/device-code fallback, GitHub Enterprise Server / `ghe.com`, and bringing your own OAuth or GitHub App.
 
-**Running headless (CI, Kubernetes, background agents)?** The stdio server can authenticate as a **GitHub App installation** with no browser, device code, or elicitation — see **[GitHub App Server-to-Server Authentication](docs/github-app-auth.md)**. This injects a high-privilege credential alongside the agent, so read the security guidance there first; it is not recommended without an independent security review.
+For non-interactive stdio deployments, see **[GitHub App Authentication](docs/github-app-auth.md)**.
 
 **Or authenticate with a Personal Access Token.** Set `GITHUB_PERSONAL_ACCESS_TOKEN` instead (it takes precedence over OAuth):
 

cmd/github-mcp-server/main.go

@@ -40,11 +40,6 @@ var (
 		Long:  `Start a server that communicates via standard input/output streams using JSON-RPC messages.`,
 		RunE: func(_ *cobra.Command, _ []string) error {
 			token := viper.GetString("personal_access_token")
-
-			// GitHub App server-to-server auth (non-interactive). It is detected
-			// when any app-* setting is present; a partial configuration yields a
-			// clear error from the loader/validator below rather than silently
-			// falling back to another mode.
 			appID := viper.GetString("app-id")
 			appInstallationID := viper.GetString("app-installation-id")
 			appPrivateKeyPath := viper.GetString("app-private-key-path")
@@ -59,14 +54,13 @@ var (
 			// --oauth-client-id. Recognizing the host via NormalizeHost means an explicit
 			// GITHUB_HOST=github.com (or api.github.com) still counts as the default and keeps
 			// zero-config login working. The secret tracks the id, so an explicitly provided
-			// id with no secret never picks up the baked-in secret. App auth opts out of this
-			// default so configuring an app never accidentally enables OAuth login too.
+			// id with no secret never picks up the baked-in secret.
 			if oauthClientID == "" && !appAuthRequested && oauth.NormalizeHost(viper.GetString("host")) == "https://github.com" {
 				oauthClientID = buildinfo.OAuthClientID
 				oauthClientSecret = buildinfo.OAuthClientSecret
 			}
 			if token == "" && !appAuthRequested && oauthClientID == "" {
-				return errors.New("authentication required: set GITHUB_PERSONAL_ACCESS_TOKEN, configure GitHub App auth (GITHUB_APP_ID, GITHUB_APP_INSTALLATION_ID and GITHUB_APP_PRIVATE_KEY_PATH), or pass --oauth-client-id to log in via OAuth")
+				return errors.New("authentication required: set GITHUB_PERSONAL_ACCESS_TOKEN, configure GitHub App auth, or pass --oauth-client-id to log in via OAuth")
 			}
 			if appAuthRequested && token != "" {
 				return errors.New("GitHub App authentication and GITHUB_PERSONAL_ACCESS_TOKEN are mutually exclusive: set only one")
@@ -137,7 +131,6 @@ var (
 			// client. The requested scopes default to the full supported set
 			// (which filters out no tools); an explicit, narrower --oauth-scopes
 			// both narrows the grant and hides tools needing other scopes.
-			// Skipped for GitHub App auth, which sources tokens non-interactively.
 			if token == "" && !appAuthRequested {
 				scopes := ghoauth.SupportedScopes
 				if viper.IsSet("oauth-scopes") {
@@ -156,15 +149,12 @@ var (
 				stdioServerConfig.OAuthScopes = scopes
 			}
 
-			// GitHub App server-to-server auth: load and parse the private key,
-			// then resolve the REST base URL so the server can mint installation
-			// tokens for the configured host (github.com, GHES, or ghe.com).
 			if appAuthRequested {
-				appConfig, err := buildAppAuthConfig(appID, appInstallationID, appPrivateKeyPath, appPrivateKeyInline, viper.GetString("host"))
+				tokenProvider, err := newGitHubAppTokenProvider(appID, appInstallationID, appPrivateKeyPath, appPrivateKeyInline, viper.GetString("host"))
 				if err != nil {
 					return err
 				}
-				stdioServerConfig.AppAuth = appConfig
+				stdioServerConfig.TokenProvider = tokenProvider
 			}
 
 			return ghmcp.RunStdioServer(stdioServerConfig)
@@ -263,11 +253,7 @@ func init() {
 	stdioCmd.Flags().StringSlice("oauth-scopes", nil, "Comma-separated OAuth scopes to request; also filters tools to those scopes. Defaults to the full supported set")
 	stdioCmd.Flags().Int("oauth-callback-port", 0, "Fixed local port for the OAuth callback server. Defaults to a random port; set a fixed port when mapping it through Docker")
 
-	// stdio-specific GitHub App (server-to-server) flags. Provide an app ID,
-	// installation ID, and private key to authenticate non-interactively — no
-	// browser, device code, or elicitation. Intended for headless deployments.
-	// The private key itself has no flag (only GITHUB_APP_PRIVATE_KEY): a flag
-	// would place the key in the process arguments. Prefer the key file path.
+	// The private key has no flag because passing it in argv would expose it.
 	stdioCmd.Flags().String("app-id", "", "GitHub App ID or client ID, enabling non-interactive server-to-server authentication")
 	stdioCmd.Flags().String("app-installation-id", "", "GitHub App installation ID to mint installation access tokens for")
 	stdioCmd.Flags().String("app-private-key-path", "", "Path to the GitHub App private key (PEM). Preferred over GITHUB_APP_PRIVATE_KEY: keeps the key off the command line and out of the environment")
@@ -326,19 +312,11 @@ func main() {
 	}
 }
 
-// buildAppAuthConfig assembles the GitHub App server-to-server configuration:
-// it loads and parses the private key and resolves the REST base URL for the
-// configured host. The private key is read from a file (preferred) or an inline
-// environment value; a missing or partial configuration yields a clear error.
-func buildAppAuthConfig(appID, installationID, keyPath, keyInline, host string) (*githubapp.Config, error) {
+func newGitHubAppTokenProvider(appID, installationID, keyPath, keyInline, host string) (func() string, error) {
 	keyBytes, err := loadAppPrivateKey(keyPath, keyInline)
 	if err != nil {
 		return nil, err
 	}
-	privateKey, err := githubapp.ParsePrivateKey(keyBytes)
-	if err != nil {
-		return nil, fmt.Errorf("invalid GitHub App private key: %w", err)
-	}
 
 	apiHost, err := utils.NewAPIHost(host)
 	if err != nil {
@@ -349,22 +327,18 @@ func buildAppAuthConfig(appID, installationID, keyPath, keyInline, host string)
 		return nil, fmt.Errorf("failed to resolve REST URL for GitHub App authentication: %w", err)
 	}
 
-	cfg := &githubapp.Config{
+	provider, err := githubapp.NewProvider(githubapp.Config{
 		AppID:          appID,
 		InstallationID: installationID,
-		PrivateKey:     privateKey,
+		PrivateKeyPEM:  keyBytes,
 		BaseRESTURL:    restURL.String(),
+	}, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to configure GitHub App authentication: %w", err)
 	}
-	if err := cfg.Validate(); err != nil {
-		return nil, err
-	}
-	return cfg, nil
+	return provider.AccessToken, nil
 }
 
-// loadAppPrivateKey returns the GitHub App private key bytes from a file path
-// (preferred — it keeps the key off argv and out of the environment) or from an
-// inline value. The inline form tolerates literal "\n" escapes so a PEM survives
-// being carried in a single-line environment variable.
 func loadAppPrivateKey(path, inline string) ([]byte, error) {
 	switch {
 	case path != "":

cmd/github-mcp-server/main_test.go

@@ -0,0 +1,38 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLoadAppPrivateKey(t *testing.T) {
+	t.Run("file", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "app.pem")
+		require.NoError(t, os.WriteFile(path, []byte("from-file"), 0o600))
+
+		key, err := loadAppPrivateKey(path, "from-inline")
+		require.NoError(t, err)
+		assert.Equal(t, []byte("from-file"), key)
+	})
+
+	t.Run("inline", func(t *testing.T) {
+		key, err := loadAppPrivateKey("", `first\nsecond`)
+		require.NoError(t, err)
+		assert.Equal(t, []byte("first\nsecond"), key)
+	})
+
+	t.Run("missing", func(t *testing.T) {
+		_, err := loadAppPrivateKey("", "")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "private key")
+	})
+}
+
+func TestGitHubAppFlagsAreStdioOnly(t *testing.T) {
+	assert.NotNil(t, stdioCmd.Flags().Lookup("app-id"))
+	assert.Nil(t, httpCmd.Flags().Lookup("app-id"))
+}