github
feat: add token source flag, gh cli auth
This PR adds support for using the GitHub CLI's token. Users pass --token-source gh to enable it (defaulting to "env" token source). It also includes a couple of changes that should make it straightforward to publish a GitHub CLI extension (#215) that uses "gh" as the default source.
Wondering if this should be leveraging cli/go-gh like it is or potentially instances of the MCP server being their own OAuth applications i.e. having their own client ID which could be implemented using this
@pauldthomson Definitely agree, there should be some tooling provided by github-mcp-server to acquire the token so users aren't stuck generating PATs.
There is a broader discussion to be had about how fine-grained authorization could be handled by the server, given many users want to grant varying levels of access to different resources (e.g. read-write access to current repo, but read-only access to other repos). It could go a long way to addressing the perennial claims of github-mcp-server being "exploited" by poisoned prompts to extract private data.
