[MayorFaj]

This PR adds an opt-in packages toolset for GitHub Packages, with two consolidated tools.

Closes #1208

Tools

packages_read (read-only, requires read:packages)

Method	Owner
list_org_packages, get_org_package, list_org_package_versions, get_org_package_version	org
list_user_packages, get_user_package, list_user_package_versions, get_user_package_version	username, or the authenticated user when omitted

The list methods support the package_type and visibility filters (packages), the state filter (versions), and page/perPage.

packages_write (destructiveHint: true, requires read:packages + delete:packages)

delete_org_package, delete_org_package_version, delete_user_package, delete_user_package_version

Notes for review

• Opt-in: packages is not added to the default toolset.
• New scope: this adds a delete:packages scope to pkg/scopes. It is not requested by default (same treatment as delete_repo), so it is only requested through a per-tool scope challenge.
• No elicitation on delete: deletes don't use the delete_repository elicitation flow. Deleted packages and versions can be restored for 30 days, and the other delete operations here (issues, discussion comments) rely on destructiveHint. Happy to add confirmation if you'd prefer.
• Other-user version listing: go-github's Users.ListUserPackageVersions doesn't accept list options, so listing another user's package versions builds the request directly to pass state/page/per_page. I verified that the endpoint honors them.
• No IFC labels: there's no existing package label in pkg/ifc. I can add one as a follow-up if wanted.
• No download stats: download counts are not exposed by the REST API, so they aren't returned.

Testing

• go test ./... and script/lint pass. Toolsnaps and docs are regenerated with UPDATE_TOOLSNAPS=true / script/generate-docs.
• Live-tested a local build over stdio:
  • org methods against kgateway-dev, including pagination, filters, and slash-containing names like charts/kgateway
  • user methods against public user packages, plus the authenticated user
  • delete paths against non-existent packages, which return a 404
  • --read-only, which hides packages_write

Note: Download statistics are not available through the GitHub REST API and are not included in responses, though they are visible on the GitHub web interface.

Closes: #1208

[Copilot]

Pull Request Overview

This PR introduces a comprehensive GitHub Packages toolset to the GitHub MCP Server, enabling management and retrieval of package information for both organizations and users. The addition provides nine package-related operations including listing, retrieving details, and deletion capabilities for packages and their versions.

• Adds a new "packages" toolset with read/write operations for managing GitHub packages
• Implements comprehensive test coverage for all package operations with proper error handling scenarios
• Updates documentation to include the new packages toolset with detailed tool descriptions

Reviewed Changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/github/tools.go	Adds packages toolset metadata and integrates it into the default toolset group
pkg/github/packages.go	Implements all package-related operations with proper error handling and API interactions
pkg/github/packages_test.go	Comprehensive test suite covering all package operations with success and error scenarios
pkg/github/toolsnaps/*.snap	Generated tool snapshots for all package operations with proper schema definitions
docs/remote-server.md	Documents the new packages toolset with installation links
README.md	Updates toolset list and adds detailed package tool documentation

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[MayorFaj]

[MayorFaj]

@SamMorrowDrums PTAL

[JoannaaKL]

Thank you for your contribition @MayorFaj! A few things to address before we can merge this pr:

Blocking

• The build is broken after the latest main merge, the imports in packages.go/packages_test.go need updating.
• #3398 requires typed outputs, so TestToolDefinitionsUseConcreteOutputTypes fails for both tools. See ProjectsGetOutput/ProjectsWriteOutput for the method-tagged pattern, then regenerate the toolsnaps.
• package_type is required by all three list-packages endpoints (they return 422 without it), so it can't be optional for list_org_packages/list_user_packages.

Additional asks

• Return trimmed package/version types instead of raw github.Package, which embeds the full owner and repository objects. Keep metadata.container.tags on versions.
• delete_user_* silently ignores org and acts on the authenticated user. Reject mismatched owner args, or use owner + owner_type like projects_*.
• Nit: note in the descriptions that the Packages API only accepts classic PATs/OAuth app tokens, and that the /users/{username} get/version endpoints are public-only.

[MayorFaj]

Thanks @JoannaaKL

All addressed:

• Fixed the /v2 imports.
• Added method-tagged typed outputs (following the projects_* pattern) and regenerated the toolsnaps.
• package_type is now required for the list methods.
• Results use trimmed package/version types; versions keep container.tags.
• user_* methods now reject org and org_* methods reject username.
• Added the token and public-only notes to the descriptions.

Tests and lint pass, and I live-tested both tools against real packages.