root mcp endpoint should return 401 when tools require it

[erwinkramer]

MCP Server roots should return 401 in some cases. For instance, the MCP server from GitHub returns 401 on the root when not passing authorization: https://api.githubcopilot.com/mcp

This works well for clients that install an MCP server, because it will directly challenge auth before using tools.

I'm suggesting to either make the auth configurable (simple boolean) for the MCP root, or to have to server automatically lock it down with 401 as soon as it sees an OAuth flow registered in the MCP server. Please note, the well-known endpoint(s) should always be anonymously accessible regardless of the new 401 behavior: https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp

You can see here how VS Code behaves with auth when installing an MCP server (so before you are even using the tools) - this won't happen when the root is publicly accessible.

2026-01-19 09:11:06.817 [info] Starting server github-mcp-server
2026-01-19 09:11:06.818 [info] Connection state: Starting
2026-01-19 09:11:06.818 [info] Starting server from LocalProcess extension host
2026-01-19 09:11:06.858 [info] Connection state: Running
2026-01-19 09:11:06.858 [debug] [editor -> server] {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{"roots":{"listChanged":true},"sampling":{},"elicitation":{"form":{},"url":{}},"tasks":{"list":{},"cancel":{},"requests":{"sampling":{"createMessage":{}},"elicitation":{"create":{}}}}},"clientInfo":{"name":"Visual Studio Code","version":"1.108.0"}}}
2026-01-19 09:11:06.860 [trace] Fetching https://api.githubcopilot.com/mcp with options: {"method":"POST","headers":{"Content-Type":"application/json","Content-Length":"351","Accept":"text/event-stream, application/json","user-agent":"Visual Studio Code/1.108.0"},"body":"{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-11-25\",\"capabilities\":{\"roots\":{\"listChanged\":true},\"sampling\":{},\"elicitation\":{\"form\":{},\"url\":{}},\"tasks\":{\"list\":{},\"cancel\":{},\"requests\":{\"sampling\":{\"createMessage\":{}},\"elicitation\":{\"create\":{}}}}},\"clientInfo\":{\"name\":\"Visual Studio Code\",\"version\":\"1.108.0\"}}}"}
2026-01-19 09:11:07.235 [trace] Fetched https://api.githubcopilot.com/mcp: {"status":401,"headers":{"content-length":"51","content-security-policy":"default-src 'none'; sandbox","content-type":"text/plain; charset=utf-8","date":"Mon, 19 Jan 2026 08:11:07 GMT","proxy-support":"Session-Based-Authentication","strict-transport-security":"max-age=31536000","www-authenticate":"Bearer error=\"invalid_request\", error_description=\"No access token was provided in this request\", resource_metadata=\"https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp\"","x-content-type-options":"nosniff","x-github-backend":"Kubernetes","x-github-request-id":"BD78:28E43A:110AE23:1487F4F:696DE71B"}}
2026-01-19 09:11:07.236 [debug] Found resource_metadata challenge in WWW-Authenticate header: https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp
2026-01-19 09:11:07.237 [trace] Fetching https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp with options: {"method":"GET","headers":{"Accept":"application/json","MCP-Protocol-Version":"2025-11-25","user-agent":"Visual Studio Code/1.108.0"}}
2026-01-19 09:11:07.540 [trace] Fetched https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp: {"status":200,"headers":{"access-control-allow-headers":"Content-Type, Authorization, X-MCP-Readonly, X-MCP-Toolsets, Mcp-Session-Id","access-control-allow-methods":"GET, POST, OPTIONS","access-control-allow-origin":"*","access-control-expose-headers":"Mcp-Session-Id","access-control-max-age":"86400","content-length":"433","content-security-policy":"default-src 'none'; sandbox","content-type":"application/json, application/json","date":"Mon, 19 Jan 2026 08:11:07 GMT","server":"github-mcp-server-remote","strict-transport-security":"max-age=31536000","x-github-backend":"Kubernetes","x-github-request-id":"BD77:3EA38C:10FD8A4:147C071:696DE71B"}}
2026-01-19 09:11:07.541 [info] Discovered resource metadata at https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp
2026-01-19 09:11:07.541 [info] Using auth server metadata url: https://github.com/login/oauth
2026-01-19 09:11:07.541 [debug] Fetching auth server metadata for: https://github.com/login/oauth ...
2026-01-19 09:11:07.541 [trace] Fetching https://github.com/.well-known/oauth-authorization-server/login/oauth with options: {"method":"GET","headers":{"Accept":"application/json","user-agent":"Visual Studio Code/1.108.0"}}
2026-01-19 09:11:07.774 [trace] Fetched https://github.com/.well-known/oauth-authorization-server/login/oauth: {"status":200,"headers":{"accept-ranges":"bytes","cache-control":"max-age=0, private, must-revalidate","content-encoding":"gzip","content-length":"231","content-security-policy":"default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com marketplace-screenshots.githubusercontent.com/ copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/","content-type":"application/json; charset=utf-8","date":"Mon, 19 Jan 2026 08:11:07 GMT","etag":"W/\"66b46c930cf6d7ae118933acf1cc8312\"","referrer-policy":"origin-when-cross-origin, strict-origin-when-cross-origin","server":"github.com","set-cookie":"logged_in=no; Path=/; Domain=github.com; Expires=Tue, 19 Jan 2027 08:11:07 GMT; HttpOnly; Secure; SameSite=Lax","strict-transport-security":"max-age=31536000; includeSubdomains; preload","vary":"X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With,Accept-Encoding, Accept, X-Requested-With","x-content-type-options":"nosniff","x-frame-options":"deny","x-github-request-id":"6073:2833C5:1EC9E88D:1960F146:696DE71B","x-xss-protection":"0"}}
2026-01-19 09:11:07.775 [info] Discovered authorization server metadata at https://github.com/.well-known/oauth-authorization-server/login/oauth
2026-01-19 09:11:07.779 [trace] Fetching https://api.githubcopilot.com/mcp with options: {"method":"POST","headers":{"Content-Type":"application/json","Content-Length":"351","Accept":"text/event-stream, application/json","user-agent":"Visual Studio Code/1.108.0","Authorization":"***"},"body":"{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-11-25\",\"capabilities\":{\"roots\":{\"listChanged\":true},\"sampling\":{},\"elicitation\":{\"form\":{},\"url\":{}},\"tasks\":{\"list\":{},\"cancel\":{},\"requests\":{\"sampling\":{\"createMessage\":{}},\"elicitation\":{\"create\":{}}}}},\"clientInfo\":{\"name\":\"Visual Studio Code\",\"version\":\"1.108.0\"}}}"}
2026-01-19 09:11:08.283 [trace] Fetched https://api.githubcopilot.com/mcp: {"status":200,"headers":{"access-control-allow-headers":"Content-Type, Authorization, X-MCP-Readonly, X-MCP-Toolsets, Mcp-Session-Id","access-control-allow-methods":"GET, POST, OPTIONS","access-control-allow-origin":"*","access-control-expose-headers":"Mcp-Session-Id","access-control-max-age":"86400","cache-control":"no-cache, no-transform","content-security-policy":"default-src 'none'; sandbox","content-type":"text/event-stream","date":"Mon, 19 Jan 2026 08:11:08 GMT","mcp-session-id":"88bb797d-707c-42cc-959b-d289478fced4","server":"github-mcp-server-remote","strict-transport-security":"max-age=31536000","transfer-encoding":"chunked","x-github-backend":"Kubernetes","x-github-request-id":"BD78:28E43A:110B0A7:1488238:696DE71B"}}
2026-01-19 09:11:08.286 [debug] [server -> editor] {"jsonrpc":"2.0","id":1,"result":{"capabilities":{"completions":{},"prompts":{},"resources":{},"tools":{}},"instructions":"The GitHub MCP Server provides tools to interact with GitHub platform.\n\nTool selection guidance:\n\t1. Use 'list_*' tools for broad, simple retrieval and pagination of all items of a type (e.g., all issues, all PRs, all branches) with basic filtering.\n\t2. Use 'search_*' tools for targeted queries with specific criteria, keywords, or complex filters (e.g., issues with certain text, PRs by author, code containing functions).\n\nContext management:\n\t1. Use pagination whenever possible with batches of 5-10 items.\n\t2. Use minimal_output parameter set to true if the full information is not needed to accomplish a task.\n\nTool usage guidance:\n\t1. For 'search_*' tools: Use separate 'sort' and 'order' parameters if available for sorting results - do not include 'sort:' syntax in query strings. Query strings should contain only search criteria (e.g., 'org:google language:python'), not sorting instructions. Always call 'get_me' first to understand current user permissions and context. ## Issues\n\nCheck 'list_issue_types' first for organizations to use proper issue types. Use 'search_issues' before creating new issues to avoid duplicates. Always set 'state_reason' when closing issues. ## Pull Requests\n\nPR review workflow: Always use 'pull_request_review_write' with method 'create' to create a pending review, then 'add_comment_to_pending_review' to add comments, and finally 'pull_request_review_write' with method 'submit_pending' to submit the review for complex reviews with line-specific comments.\n\nBefore creating a pull request, search for pull request templates in the repository. Template files are called pull_request_template.md or they're located in '.github/PULL_REQUEST_TEMPLATE' directory. Use the template content to structure the PR description and then call create_pull_request tool.\n\nHere are common scenarios you may encounter, followed by a description of the steps to follow and the tools to use. Match these to user requests:\nIf the user is bootstrapping a new project, you MUST always follow this workflow:\n- STEP 1: Set up a repository for the project unless one has already been set up by the user.\n- STEP 2: If a repository for the project exists, use issues tools to create at least one tracking issue for the project.\nWhen the user requests to search for issues in a repository using natural language, use the semantic_issues_search tool over search_issues.","protocolVersion":"2025-11-25","serverInfo":{"name":"github-mcp-server","title":"GitHub MCP Server","version":"github-mcp-server/remote-2f9d9c53d8f07429d22eafb212b52bdeb2f3f774","icons":[{"src":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABgAAAAYCAYAAADgdz34AAAABmJLR0QA/wD/AP+gvaeTAAADK0lEQVRIibWVQWhcVRSGv3Pfy0zGdBIMRWk7iziMTpORptpqiNSNG1dNizaFFlxIoYuCC7NwJdiVlhYprtwpighCF9GtuhCRtuCoaWdqGF7HkE4aWm1CpklmJpl3j4vMS99M2k4G9N+8d8659/8u9553H/zPkscVM5lMf03do6iOKbJXIAGgUBJ0GpHvolKfzOfzCx0BEonRWDRemRD0PaC3zSKXED1fLfdcLJUuV9oC0ukXdluxkyq81Ma4VX9Y4x4p5rOzjwSkUvsSdMkVYE+H5oHmjM9IoTA1FyRM8JJIjMbokm83zUW/Vvi5raXwC8rnjWiPdXRyYGCgOyi7wUs0XpkAXmyEa/XV8qmZmZnqc0P7XrXKW2BuKDovgorqLoWMFb4p3rj2I4w7qcHCMSAOctDt7n0X+GiDT6NbrPsXDw50xftzKg7odvcmtXf4DsJTjXBpzbXPzF6/vmgAauoepblbnGTyQLvu2VQmk4kgxEKpvui6cwSCM1Ada5qheq5YzC5tF5DP59dQzjYlZcOzccgyGK65mC+2ax7IWPfLcGxhKARgV7i4vBy70ymgUMj+A9SDWGB3GOCEB/f0VJ/sFJBKjfQS6srAOwD8HR7su/7BTgE2Umn98u9uAgR+ayqpnOkUIK1zZMPTACjyQzOA11ND+z+E8aate4TMs4PD7wu80ezP940nJJMH+ky0XgKeAHkH1TcRXgNywFeoueJN//5T2CCZGT7kWBlV9CSwvwV6n/XuhOddLRuAYjG7hMjHgEH1tEb0BEgWeB44J8aebF2243Nc0fMPMUfgguddLUOoe/r7dlwWJzqGMCxq6q5Wz/jSVQZ+Nb795N69u4thk/6dT7uInNiyYcoU9ZW3FxYWfAjdpp7n1XzjHAbmUJ3wTXQ8gvOZb+oXV1d3zLf6WEcWW3MoJXX9w57n1YKUCdeL+eysOv4oyrQqn65Tv+1adz4WrxzaskXWNs0V5Jq6/is3c7lb4byhRTdzuVvUV0ZQPgDuA6jqlj+fqhvkllE9q+vLL7eab4Afo1RqpJdI9Rhr3ZeCQwuUTqfjvoket7WuS51cjP+5/gWC8y5uIkrtDQAAAABJRU5ErkJggg==","mimeType":"image/png","theme":"light"},{"src":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABgAAAAYCAYAAADgdz34AAAABmJLR0QA/wD/AP+gvaeTAAAB8ElEQVRIibWVu09UQRSHv9k1IgW7AY0RBWKsTGx9ND4qS5F/wEYLDb0xAY0UxkdrZ2NHYWfsaYyVT4iJwZpNjJooLBQEYz6LvZsdxmH3LtFfN3PO+X5zzzwu/GeFbkF1BJgCJoHjwFgRagDLwAvgeQjhR1+u6qA6q67ZW6vqjDpYFn5YfV0CnOqDOtELPqY2dgFvq6Ee6daWd1HyvPqyBPSV+jQav1H3tbkhMpgF7hXDLaAeQthUzwFXgE/AF0BgFDgBPAshLKhV4CcwVNTPhBAexKsfcfuGbqhdT1imA1+j+lV1GKBSxKeAWpRfTca94HuB+BTVgcuxwWRS8zCEsFbWIISwBcwl0x2m+jnZuKNl4RHjQMJYjoPNJFju0vxt8itiNKHTomqSO7wLeA3YE01VYoPvSf7Jfg2AU8n4W2zwPglO78Igrekw1enMDb1fXKCuUivq7Uz99Tiprq6rvwuzhSLpo3pLvZABn1Vv2nrkUjWLPdlWMFcEF9WD6tuo4EnG4HEG3Nad3KcOqEtRe/bb+ic8Uo9l8i/tAF9UB3bq54StJ3dTvaGOqofM3IuiRalW1PH8bnUKx4tVxLqYyTuf5Czl4JV0IoSwApwB7gLr7enMWtpzG7TeodNFbXmpNfWq6YloxYbUa2q9L+i/1h8/EAGdUrF9ZQAAAABJRU5ErkJggg==","mimeType":"image/png","theme":"dark"}]}}}