GitHub MCP Server 1.10.0 gates repository deletion behind elicitation and hardens credentials, symlinks and request limits

GitHub released version 1.10.0 of github-mcp-server on 2026-08-19, and the release notes open by calling it "a substantial security, reliability, and compatibility release". It is the first minor version since 1.9.0 on 2026-08-10.

The change with the most protocol substance is the new confirmation path for repository deletion. The tool now requires a form elicitation with protected multi-round-trip state, which puts an MRTR flow from the 2026-07-28 revision into production on a flagship server rather than in a specification example. Alongside it, notification subscription tools now explicitly advertise destructive behaviour so clients can surface that to a user.

Several of the credential and transport changes address classes that other records in the same week describe elsewhere. Bearer credentials are now restricted to configured GitHub authorities, HTTPS is enforced for GitHub Enterprise Server hosts, and oversized HTTP request bodies are rejected early, which is the same unbounded-read class the Java SDK published two advisories for on the same day. Symbolic-link handling changed in both directions: get_file_contents now identifies symbolic links and labels dereferenced content, and writing through a symlink requires an explicit allow_symlink_write: true, the same canonicalization gap that produced the chrome-devtools-mcp roots advisory two days earlier. The release also hardens lockdown, request limits, cache isolation, URL traversal and response sanitization across seven further pull requests, and a request can no longer relax lockdown the server enforces.

Four behaviour changes are called out as breaking in practice. Unknown names in a static --tools configuration now prevent startup instead of being ignored, symbolic-link writes need the new opt-in, requests cannot relax server-enforced lockdown, and oversized request bodies are rejected. On tool contracts, zero-parameter tools now accept an omitted arguments property while still rejecting an explicit null and malformed JSON, and issue_write accepts issue_fields[].delete: false as a valid no-op for strict-schema clients.

The GitHub Enterprise Server compatibility work covers list_issues and search_issues degrading safely when issue custom-field GraphQL types are unavailable, assignee logins and stable empty arrays for unassigned issues, and validation failures exposing ruleset details when the API supplies them. Version 1.10.1, published the following day, contains one change: a fix for an add_issue_comment schema compatibility regression introduced by 1.10.0's own correction to that tool's input modes.