Add ifc label for search_repositories tool

Emits an IFC SecurityLabel on the search_repositories tool result when
the InsidersMode flag is enabled, mirroring the pattern landed for
get_me (#2432), list_issues (#2453), get_file_contents (#2454),
search_issues (#2456), and issue_read (#2457).

Search results may span multiple repositories, so the join math
(integrity always untrusted; private wins by intersecting collaborator
sets across the matched private repos only) is shared with search_issues
via ifc.LabelSearchIssues. Visibility is read directly off the search
response's repo.Private field — no extra API call. Collaborators are
fetched only for private hits, and any failure causes the label to be
omitted entirely (consistent with search_issues / issue_read /
get_file_contents).

Refs github/copilot-mcp-core#1623, github/copilot-mcp-core#1389.

Author: gokhanarkan

pkg/github/search.go

@@ -8,6 +8,7 @@ import (
 	"net/http"
 
 	ghErrors "github.com/github/github-mcp-server/pkg/errors"
+	"github.com/github/github-mcp-server/pkg/ifc"
 	"github.com/github/github-mcp-server/pkg/inventory"
 	"github.com/github/github-mcp-server/pkg/scopes"
 	"github.com/github/github-mcp-server/pkg/translations"
@@ -161,11 +162,60 @@ func SearchRepositories(t translations.TranslationHelperFunc) inventory.ServerTo
 				}
 			}
 
-			return utils.NewToolResultText(string(r)), nil, nil
+			callResult := utils.NewToolResultText(string(r))
+			if deps.GetFlags(ctx).InsidersMode {
+				attachSearchRepositoriesIFCLabel(ctx, client, result.Repositories, callResult)
+			}
+			return callResult, nil, nil
 		},
 	)
 }
 
+// attachSearchRepositoriesIFCLabel joins per-repository IFC labels across
+// every matched repository and attaches the result to callResult. Visibility
+// is read directly from the search response (no extra API call); collaborators
+// are fetched once per private repository. If any collaborators lookup fails
+// the label is omitted to avoid misclassifying the result. The join math is
+// shared with search_issues via ifc.LabelSearchIssues: integrity is always
+// untrusted, and confidentiality is the intersection of the reader sets of
+// the matched private repositories (public matches contribute the universe
+// set and drop out without shrinking it).
+func attachSearchRepositoriesIFCLabel(ctx context.Context, client *github.Client, repos []*github.Repository, callResult *mcp.CallToolResult) {
+	if callResult == nil || callResult.IsError {
+		return
+	}
+
+	visibilities := make([]bool, 0, len(repos))
+	readerSets := make([][]string, 0, len(repos))
+	for _, repo := range repos {
+		isPrivate := repo.GetPrivate()
+		visibilities = append(visibilities, isPrivate)
+		if !isPrivate {
+			readerSets = append(readerSets, nil)
+			continue
+		}
+		owner := repo.GetOwner().GetLogin()
+		name := repo.GetName()
+		if owner == "" || name == "" {
+			return
+		}
+		collaborators, err := FetchRepoCollaborators(ctx, client, owner, name)
+		if err != nil {
+			return
+		}
+		readerSets = append(readerSets, collaborators)
+	}
+
+	label, ok := ifc.LabelSearchIssues(visibilities, readerSets)
+	if !ok {
+		return
+	}
+	if callResult.Meta == nil {
+		callResult.Meta = mcp.Meta{}
+	}
+	callResult.Meta["ifc"] = label
+}
+
 // SearchCode creates a tool to search for code across GitHub repositories.
 func SearchCode(t translations.TranslationHelperFunc) inventory.ServerTool {
 	schema := &jsonschema.Schema{

pkg/github/search_test.go

@@ -163,9 +163,187 @@ func Test_SearchRepositories(t *testing.T) {
 				assert.Equal(t, *tc.expectedResult.Repositories[i].FullName, repo.FullName)
 				assert.Equal(t, *tc.expectedResult.Repositories[i].HTMLURL, repo.HTMLURL)
 			}
+		})
+	}
+}
+
+func Test_SearchRepositories_IFC_InsidersMode(t *testing.T) {
+	t.Parallel()
 
+	serverTool := SearchRepositories(translations.NullTranslationHelper)
+
+	type repoFixture struct {
+		owner               string
+		name                string
+		isPrivate           bool
+		collaborators       []string
+		collaboratorsStatus int
+	}
+
+	makeRepo := func(r repoFixture) *github.Repository {
+		return &github.Repository{
+			ID:       github.Ptr(int64(1)),
+			Name:     github.Ptr(r.name),
+			FullName: github.Ptr(r.owner + "/" + r.name),
+			Private:  github.Ptr(r.isPrivate),
+			Owner:    &github.User{Login: github.Ptr(r.owner)},
+		}
+	}
+
+	makeMockClient := func(repos []repoFixture) *http.Client {
+		searchResult := &github.RepositoriesSearchResult{
+			Total:             github.Ptr(len(repos)),
+			IncompleteResults: github.Ptr(false),