github-mcp-server 1.11.0 requests OAuth scopes per tool call instead of up front

GitHub released github-mcp-server 1.11.0 on 2026-08-25, three weeks after the 1.10.0 security release. The headline change is authorization granularity: per-call OAuth scope checks mean each tool invocation requests only the permissions that call needs, with runtime checks where required, instead of the server holding one broad grant for everything it might do. The work landed in PR #3128.

The rest of the release also leans toward remote-deployment plumbing. CORS now holds across the OAuth discovery routes (PR #3147), which matters for browser-based clients walking authorization-server metadata, and a new --authorization-server flag lets an operator point the server at a different authorization server URL (PR #2900). The REST transport gains ETag conditional requests (PR #3026), so repeated reads can answer from cache validation rather than full payloads. On the workflow side, parent issues and sub-issues can now be created atomically in one call (PR #3134). The runtime moves to Go 1.27, alongside routine dependency updates.

The release notes state no security advisories, and none were published against the repository in this window.