Add confirmed repository deletion tool

[SamMorrowDrums]

Summary

Adds a destructive delete_repository MCP tool that deletes a repository only after the user enters the exact owner/repo name through elicitation. The tool is exposed only for MCP protocol 2026-07-28 and newer when the client supports form elicitation.

Why

Repository deletion needs a stronger confirmation boundary than ordinary write operations. Self-hosted stateless HTTP deployments also need authenticated encryption for client-held MRTR request state so retries cannot alter the confirmed target.

N/A - no linked issue.

What changed

• Added delete_repository with the delete_repo OAuth scope, destructive annotations, and exact repository-name confirmation.
• Added reusable server-tool availability metadata for minimum protocol versions and required elicitation modes.
• Filtered unavailable tools from tools/list and enforced direct calls inside registered handlers across stdio and remote HTTP transports.
• Bound the deletion target into encrypted MRTR request state for self-hosted HTTP using GITHUB_MCP_SERVER_MRTR_STATE_KEY.
• Added an optional github.RequestStateSealer provider contract so hosted integrations can retain their existing key format without changing ToolDependencies.
• Added unit, in-memory multi-round-trip, remote HTTP availability, tamper, target-binding, and inventory-fallback coverage plus the generated tool snapshot and documentation.

MCP impact

• No tool or API changes
• Tool schema or behavior changed
• New tool added

The new schema accepts owner and repo; execution then requests repository_name through multi-round-trip form elicitation before calling GitHub's delete repository API. HTTP mode exposes the tool only when a valid request-state encryption key is configured.

Prompts tested (tool changes only)

• "Delete the owner/repo repository" - automated in-memory MCP coverage verifies elicitation, exact matching, refusal paths, tamper rejection, target binding, and successful deletion.

Security / limits

• No security or limits impact
• Auth / permissions considered
• Data exposure, filtering, or token/size limits considered

The tool requires the dedicated delete_repo OAuth scope, refuses declined or mismatched confirmation, and is hidden and refused unless the request uses protocol 2026-07-28 or newer and advertises form elicitation support. Self-hosted HTTP uses AES-256-GCM request-state protection; missing keys hide only this tool and malformed keys fail startup.

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
  • I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR

Note: if you're renaming tools, you must add the tool aliases. For more information on how to do so, please refer to the official docs.

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Docs

• Not needed
• Updated (README / docs / examples)

[Copilot]

Pull request overview

Adds protocol-gated, elicitation-confirmed repository deletion.

Changes:

• Adds delete_repository with delete_repo scope and destructive annotations.
• Filters tools by minimum MCP protocol version.
• Adds schema, unit, transport, and documentation updates.

Show a summary per file

File	Description
README.md	Documents the new tool.
pkg/scopes/scopes.go	Defines delete_repo.
pkg/scopes/scopes_test.go	Tests scope expansion.
pkg/inventory/server_tool.go	Adds minimum protocol metadata.
pkg/inventory/registry.go	Installs protocol filtering.
pkg/inventory/protocol_version.go	Implements listing/call filtering.
pkg/inventory/protocol_version_test.go	Tests protocol gating.
pkg/http/handler_test.go	Tests HTTP tool visibility.
pkg/github/tools.go	Registers the deletion tool.
pkg/github/repositories.go	Implements confirmation and deletion.
pkg/github/repositories_test.go	Tests deletion and elicitation.
pkg/github/helper_test.go	Adds the mock endpoint constant.
pkg/github/__toolsnaps__/delete_repository.snap	Captures the tool schema.
internal/ghmcp/oauth.go	Reuses the protocol constant.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 14/14 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 23/23 changed files
• Comments generated: 2
• Review effort level: Balanced