GitHub MCP Server 1.12.1 advertises only default OAuth scopes in its protected-resource metadata, days after 1.12.0 added governance tools and MCP Server Card support

GitHub released github-mcp-server v1.12.0 on 2026-09-03 with what its release notes call new governance tools for agents: read and manage repository rulesets and custom properties across repository, organization, and enterprise levels (#2991, #2992). The same release added MCP Server Card support under SEP-2127 (#2768), an Agent Plugins 1.0 package (#3169), and merge-HEAD pinning for merge_pull_request so a caller can pin the expected head SHA before a merge (#3182). Feature flags also moved to functional availability rules that evaluate lazily after static filtering, per the release's highlights.

v1.12.1 followed on 2026-09-08 and describes itself as a bugfix release. Its stated problem: "Oauth protected resource metadata became too permissive in the supported scopes advertised." PR #3251, merged the same day, traces the cause to an earlier change, #3076, which had split the server's OAuth catalog into supported and default scopes but left the protected-resource metadata endpoint still wired to the full supported-scopes list. The PR's description explains why that mattered: "OAuth clients such as VS Code interpret scopes_supported as the initial authorization request, so production requested every optional scope at login."

The fix in #3251 changes the metadata to advertise DefaultScopes instead of the full catalog. Scopes outside that default set, including delete_repo, workflow, and administrative scopes, are not removed from the server; they stay reachable through per-tool authorization challenges rather than being requested up front at login. The PR closes issue #3170 and adds a regression test asserting the exact advertised scope list.

The server is cataloged; no security advisory accompanies either release, and the fix reached users through the ordinary release-notes channel rather than a GHSA record.