GitHub MCP Server 1.12.0

Highlights

• New governance tools for agents. Read and manage repository rulesets and custom properties across repository, organization, and enterprise levels.
• Faster, safer feature flags. Functional availability rules evaluate lazily after static filtering, deduplicate checks per request, and preserve precise availability errors.
• Safer write operations. Pin merge HEADs, recover file SHAs, use least-privilege public-repository access, and detect silently dropped labels.
• Richer review and discovery support. Adds review range coordinates, thread resolution reasons, projected-header preflights, Server Card support, and Agent Plugins.
• Better content fidelity. Markdown bodies, titles, release notes, comments, and commit messages preserve visible content while filtering unsafe invisible characters.

What's Changed

• Remove documentation for unavailable tool-search command by @tommaso-moro in #3162
• Expose Copilot review thread resolution reasons by @cagesellchen in #3123
• fix(repos): give create_or_update_file callers a SHA they can actually get by @dylanpulver in #3131
• fix: allow public_repo for public contribution tools by @paulcakeface in #3140
• Enable feature flags via URL query parameter (?features=) for headerless hosted connections by @CAOShurong in #3146
• Add expectedHeadSha pinning to merge_pull_request by @jcosta1970 in #3182
• Fix e2e harness compilation against go-github v89 and go-sdk v1.7 by @ppoffice in #3187
• Return range coordinates for review comments by @yiheng-kkk in #3193
• Fix issue_write silently dropped label errors by @SamMorrowDrums in #3195
• fix(http): allow projected MCP headers in preflights by @SamMorrowDrums in #3167
• Spell perPage the same way in every paginated tool by @karpovantonme in #3142
• Add MCP Server Card (SEP-2127) types + handler by @SamMorrowDrums in #2768
• Refactor feature flags to use functional availability rules by @SamMorrowDrums in #3166
• feat(governance): add repository ruleset tools with multi-level scope challenge by @SamMorrowDrums in #2991
• feat(governance): add custom properties tools by @SamMorrowDrums in #2992
• Fix HTML entities in sanitized titles by @SamMorrowDrums in #3216
• build(deps): bump fast-uri from 3.1.5 to 3.1.7 in /ui in the npm_and_yarn group across 1 directory by @dependabot[bot] in #3208
• build(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #3217
• build(deps): bump github/codeql-action from 4.37.4 to 4.37.9 by @dependabot[bot] in #3192
• feat: add Agent Plugins 1.0 package by @777genius in #3169
• fix(sanitize): preserve Markdown body fidelity on read surfaces by @SamMorrowDrums in #3177
• build(deps): bump actions/stale from 10 to 11 by @dependabot[bot] in #3003
• Fix main CI sanitizer integration by @SamMorrowDrums in #3219

New Contributors

• @cagesellchen made their first contribution in #3123
• @paulcakeface made their first contribution in #3140
• @CAOShurong made their first contribution in #3146
• @jcosta1970 made their first contribution in #3182
• @ppoffice made their first contribution in #3187
• @yiheng-kkk made their first contribution in #3193
• @karpovantonme made their first contribution in #3142
• @777genius made their first contribution in #3169

Full Changelog: v1.11.0...v1.12.0

GitHub MCP Server 1.11.0

Highlights

• Smarter OAuth challenges: per-call scope checks request only the permissions each tool invocation needs with runtime checks where required.
• Improved browser OAuth support: CORS now works across OAuth discovery routes, with configurable authorization-server URLs.
• Improved sub-issue workflow: create parent and sub-issues atomically.
• Better HTTP caching for STDIO: REST responses support ETag conditional requests.
• Runtime refresh: upgraded to Go 1.27authorizationauthorization plus routine security and dependency updates.

What's Changed

• feat(http): add --authorization-server flag to override OAuth AS URL by @Anika-Sol in #2900
• Name the root command after the installed binary by @plusky in #2998
• fix(http): preserve CORS across OAuth routes by @SamMorrowDrums in #3147
• Add atomic parent issue creation by @zwick in #3134
• Add ETag conditional requests to the REST transport by @joshfree in #3026
• build(deps): bump github/codeql-action from 4 to 4.37.4 by @dependabot[bot] in #3004
• Add per-call OAuth scope checks by @SamMorrowDrums in #3128
• build(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #3157
• build(deps): bump github.com/go-chi/chi/v5 from 5.3.1 to 5.3.2 by @dependabot[bot] in #3156
• build(deps): bump distroless/base-debian12 from 76b3162 to fabbf1c by @dependabot[bot] in #3154
• build(deps): bump golang from 1.25.13-alpine to 1.27.0-alpine by @dependabot[bot] in