fix(github): preserve MCP App UI data and dispatch scopes

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: SamMorrowDrums

pkg/github/__toolsnaps__/ui_get.snap

@@ -53,12 +53,16 @@
             "items": {
               "additionalProperties": false,
               "properties": {
+                "avatar_url": {
+                  "type": "string"
+                },
                 "login": {
                   "type": "string"
                 }
               },
               "required": [
-                "login"
+                "login",
+                "avatar_url"
               ],
               "type": "object"
             },
@@ -394,12 +398,16 @@
             "items": {
               "additionalProperties": false,
               "properties": {
+                "avatar_url": {
+                  "type": "string"
+                },
                 "login": {
                   "type": "string"
                 }
               },
               "required": [
-                "login"
+                "login",
+                "avatar_url"
               ],
               "type": "object"
             },

pkg/github/typed_copilot_ui_outputs.go

@@ -158,6 +158,7 @@ func normalizeUIGetArguments(raw json.RawMessage) (json.RawMessage, error) {
 	if err != nil || args == nil {
 		return raw, err
 	}
+	delete(args, "_compat_method")
 	method, err := RequiredParam[string](args, "method")
 	if err != nil {
 		return nil, &inventory.ToolInputError{Message: err.Error()}
@@ -179,13 +180,7 @@ func normalizeUIGetArguments(raw json.RawMessage) (json.RawMessage, error) {
 			}
 		}
 	default:
-		args["method"] = "labels"
-		args["_compat_method"] = method
-		if _, exists := args["repo"]; exists {
-			if _, err := RequiredParam[string](args, "repo"); err != nil {
-				args["repo"] = ""
-			}
-		}
+		return nil, &inventory.ToolInputError{Message: fmt.Sprintf("unknown method: %s", method)}
 	}
 	return json.Marshal(args)
 }
@@ -206,7 +201,8 @@ type UIGetLabelOutput struct {
 }
 
 type UIGetAssigneeOutput struct {
-	Login string `json:"login"`
+	Login     string `json:"login"`
+	AvatarURL string `json:"avatar_url"`
 }
 
 type UIGetMilestoneOutput struct {

pkg/github/typed_copilot_ui_outputs_test.go

@@ -5,13 +5,18 @@ import (
 	"encoding/json"
 	"io"
 	"net/http"
+	"net/http/httptest"
 	"reflect"
 	"strings"
 	"testing"
 
 	ghcontext "github.com/github/github-mcp-server/pkg/context"
+	"github.com/github/github-mcp-server/pkg/http/middleware"
+	"github.com/github/github-mcp-server/pkg/http/oauth"
 	"github.com/github/github-mcp-server/pkg/inventory"
+	"github.com/github/github-mcp-server/pkg/scopes"
 	"github.com/github/github-mcp-server/pkg/translations"
+	"github.com/github/github-mcp-server/pkg/utils"
 	"github.com/google/jsonschema-go/jsonschema"
 	"github.com/modelcontextprotocol/go-sdk/mcp"
 	"github.com/shurcooL/githubv4"
@@ -274,12 +279,12 @@ func TestTypedUIGetNonemptyWireOutputs(t *testing.T) {
 		structured string
 	}{
 		{method: "labels", args: map[string]any{"method": "labels", "owner": "owner", "repo": "repo"}, structured: `{"method":"labels","labels":{"labels":[{"id":"LABEL_1","name":"bug","color":"d73a4a","description":"Something isn't working"}],"totalCount":1,"has_more":false}}`},
-		{method: "assignees", args: map[string]any{"method": "assignees", "owner": "owner", "repo": "repo"}, structured: `{"method":"assignees","assignees":{"assignees":[{"login":"octocat"}],"totalCount":1,"has_more":false}}`},
+		{method: "assignees", args: map[string]any{"method": "assignees", "owner": "owner", "repo": "repo"}, structured: `{"method":"assignees","assignees":{"assignees":[{"login":"octocat","avatar_url":"https://example.com/avatar.png"}],"totalCount":1,"has_more":false}}`},
 		{method: "milestones", args: map[string]any{"method": "milestones", "owner": "owner", "repo": "repo"}, structured: `{"method":"milestones","milestones":{"milestones":[{"number":4,"title":"v1","description":"First release","state":"open","open_issues":2,"due_on":"2026-12-31"}],"totalCount":1,"has_more":false}}`},
 		{method: "issue_types", args: map[string]any{"method": "issue_types", "owner": "owner"}, structured: `{"method":"issue_types","issue_types":[{"id":12,"name":"Bug","description":"A bug","color":"red"},null]}`},
 		{method: "branches", args: map[string]any{"method": "branches", "owner": "owner", "repo": "repo"}, structured: `{"method":"branches","branches":{"branches":[{"name":"main","sha":"abc123","protected":true}],"totalCount":1,"has_more":false}}`},
 		{method: "issue_fields", args: map[string]any{"method": "issue_fields", "owner": "owner", "repo": "repo"}, structured: `{"method":"issue_fields","issue_fields":{"fields":[{"id":"FIELD_1","name":"Priority","data_type":"text","description":"Issue priority"}],"totalCount":1}}`},
-		{method: "reviewers", args: map[string]any{"method": "reviewers", "owner": "owner", "repo": "repo"}, structured: `{"method":"reviewers","reviewers":{"users":[{"login":"octocat"}],"teams":[{"slug":"docs","name":"Docs","org":"owner"}],"totalCount":2,"has_more":false}}`},
+		{method: "reviewers", args: map[string]any{"method": "reviewers", "owner": "owner", "repo": "repo"}, structured: `{"method":"reviewers","reviewers":{"users":[{"login":"octocat","avatar_url":"https://example.com/avatar.png"}],"teams":[{"slug":"docs","name":"Docs","org":"owner"}],"totalCount":2,"has_more":false}}`},
 	}
 	for _, tc := range tests {
 		t.Run(tc.method, func(t *testing.T) {
@@ -337,6 +342,8 @@ func TestTypedCopilotUIErrorsPreserveLegacyText(t *testing.T) {
 		{name: "request_copilot_review", args: map[string]any{"repo": "repo", "pullNumber": 7}, text: "missing required parameter: owner"},
 		{name: "ui_get", args: map[string]any{"method": "labels", "owner": "owner"}, text: "missing required parameter: repo"},
 		{name: "ui_get", args: map[string]any{"method": "unknown", "owner": "owner"}, text: "unknown method: unknown"},
+		{name: "ui_get", args: map[string]any{"method": "unknown", "owner": "owner", "repo": true}, text: "unknown method: unknown"},
+		{name: "ui_get", args: map[string]any{"method": "unknown"}, text: "missing required parameter: owner"},
 		{name: "ui_get", args: map[string]any{"method": true, "owner": "owner"}, text: "parameter method is not of type string"},
 	}
 	for _, protocol := range protocols {
@@ -354,20 +361,88 @@ func TestTypedCopilotUIErrorsPreserveLegacyText(t *testing.T) {
 	}
 }
 
+func TestTypedUIGetHTTPScopesAndDispatch(t *testing.T) {
+	registry, err := inventory.NewBuilder().SetTools([]inventory.ServerTool{
+		UIGet(translations.NullTranslationHelper),
+	}).WithToolsets([]string{"all"}).Build()
+	require.NoError(t, err)
+	scopes.SetToolScopeMapFromInventory(registry)
+	t.Cleanup(func() { scopes.SetGlobalToolScopeMap(nil) })
+
+	for _, protocol := range []string{inventory.ProtocolVersionMultiRoundTrip, "2025-11-25", "", "unknown"} {
+		t.Run("protocol="+protocol, func(t *testing.T) {
+			session, _ := typedCopilotUISession(t, typedCopilotUIClient(t), protocol)
+			for _, tc := range []struct {
+				name       string
+				args       map[string]any
+				scopes     []string
+				wantStatus int
+				wantError  string
+			}{
+				{name: "unknown method does not challenge", args: map[string]any{"method": "unknown", "owner": "owner", "repo": "repo"}, scopes: []string{"gist"}, wantStatus: http.StatusOK, wantError: "unknown method: unknown"},
+				{name: "unknown method validates owner first", args: map[string]any{"method": "unknown", "repo": "repo"}, scopes: []string{"gist"}, wantStatus: http.StatusOK, wantError: "missing required parameter: owner"},
+				{name: "labels cannot be overridden to issue types", args: map[string]any{"method": "labels", "owner": "owner", "repo": "repo", "_compat_method": "issue_types"}, scopes: []string{"repo"}, wantStatus: http.StatusOK},
+				{name: "labels cannot be overridden to reviewers", args: map[string]any{"method": "labels", "owner": "owner", "repo": "repo", "_compat_method": "reviewers"}, scopes: []string{"repo"}, wantStatus: http.StatusOK},
+				{name: "issue types still require read org", args: map[string]any{"method": "issue_types", "owner": "owner", "_compat_method": "labels"}, scopes: []string{"repo"}, wantStatus: http.StatusForbidden},
+				{name: "labels still require repo", args: map[string]any{"method": "labels", "owner": "owner", "repo": "repo"}, scopes: []string{"gist"}, wantStatus: http.StatusForbidden},
+			} {
+				t.Run(tc.name, func(t *testing.T) {
+					raw, err := json.Marshal(tc.args)
+					require.NoError(t, err)
+					called := false
+					handler := middleware.WithScopeChallenge(&oauth.Config{}, nil)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+						called = true
+						result, err := session.CallTool(r.Context(), &mcp.CallToolParams{Name: "ui_get", Arguments: tc.args})
+						require.NoError(t, err)
+						if tc.wantError != "" {
+							require.True(t, result.IsError)
+							assert.Equal(t, tc.wantError, getTextResult(t, result).Text)
+							assert.Nil(t, result.StructuredContent)
+						} else {
+							require.False(t, result.IsError)
+							if protocol == inventory.ProtocolVersionMultiRoundTrip {
+								assert.JSONEq(t, `{"method":"labels","labels":{"labels":[],"totalCount":0,"has_more":false}}`, getTextResult(t, result).Text)
+							} else {
+								assert.Equal(t, `{"has_more":false,"labels":[],"totalCount":0}`, getTextResult(t, result).Text)
+							}
+						}
+						require.NoError(t, json.NewEncoder(w).Encode(result))
+					}))
+					request := httptest.NewRequest(http.MethodPost, "/mcp", nil)
+					ctx := ghcontext.WithTokenInfo(request.Context(), &ghcontext.TokenInfo{TokenType: utils.TokenTypeOAuthAccessToken})
+					ctx = ghcontext.WithTokenScopes(ctx, tc.scopes)
+					ctx = ghcontext.WithMCPMethodInfo(ctx, &ghcontext.MCPMethodInfo{
+						Method: "tools/call", ItemName: "ui_get", RawArguments: raw, ProtocolVersion: protocol,
+					})
+					response := httptest.NewRecorder()
+					handler.ServeHTTP(response, request.WithContext(ctx))
+					assert.Equal(t, tc.wantStatus, response.Code)
+					assert.Equal(t, tc.wantStatus == http.StatusOK, called)
+					if tc.wantStatus == http.StatusOK {
+						assert.Empty(t, response.Header().Get("WWW-Authenticate"))
+					} else {
+						assert.Contains(t, response.Header().Get("WWW-Authenticate"), "insufficient_scope")
+					}
+				})
+			}
+		})
+	}
+}
+
 func TestTypedUIGetUnionOutputs(t *testing.T) {
 	cases := []struct {
 		method string
 		raw    string
 		typed  string
 	}{
 		{method: "labels", raw: `{"labels":[{"id":"L","name":"bug","color":"red","description":""}],"totalCount":1,"has_more":false}`, typed: `{"method":"labels","labels":{"labels":[{"id":"L","name":"bug","color":"red","description":""}],"totalCount":1,"has_more":false}}`},
-		{method: "assignees", raw: `{"assignees":[{"login":"octocat","avatar_url":"https://example.com/avatar.png"}],"totalCount":1,"has_more":false}`, typed: `{"method":"assignees","assignees":{"assignees":[{"login":"octocat"}],"totalCount":1,"has_more":false}}`},
+		{method: "assignees", raw: `{"assignees":[{"login":"octocat","avatar_url":"https://example.com/avatar.png"}],"totalCount":1,"has_more":false}`, typed: `{"method":"assignees","assignees":{"assignees":[{"login":"octocat","avatar_url":"https://example.com/avatar.png"}],"totalCount":1,"has_more":false}}`},
 		{method: "milestones", raw: `{"milestones":[{"number":4,"title":"v1","description":"","state":"open","open_issues":2,"due_on":""}],"totalCount":1,"has_more":false}`, typed: `{"method":"milestones","milestones":{"milestones":[{"number":4,"title":"v1","description":"","state":"open","open_issues":2,"due_on":""}],"totalCount":1,"has_more":false}}`},
 		{method: "issue_types", raw: `[{"id":1,"name":"Bug"}]`, typed: `{"method":"issue_types","issue_types":[{"id":1,"name":"Bug"}]}`},
 		{method: "issue_types", raw: `null`, typed: `{"method":"issue_types","issue_types":null}`},
 		{method: "branches", raw: `{"branches":[{"name":"main","sha":"abc","protected":true}],"totalCount":1,"has_more":false}`, typed: `{"method":"branches","branches":{"branches":[{"name":"main","sha":"abc","protected":true}],"totalCount":1,"has_more":false}}`},
 		{method: "issue_fields", raw: `{"fields":[{"id":"F","name":"Priority","data_type":"single_select","description":"","options":[]}],"totalCount":1}`, typed: `{"method":"issue_fields","issue_fields":{"fields":[{"id":"F","name":"Priority","data_type":"single_select","description":"","options":[]}],"totalCount":1}}`},
-		{method: "reviewers", raw: `{"users":[{"login":"octocat","avatar_url":""}],"teams":[{"slug":"docs","name":"Docs","org":"owner"}],"totalCount":2,"has_more":false}`, typed: `{"method":"reviewers","reviewers":{"users":[{"login":"octocat"}],"teams":[{"slug":"docs","name":"Docs","org":"owner"}],"totalCount":2,"has_more":false}}`},
+		{method: "reviewers", raw: `{"users":[{"login":"octocat","avatar_url":""}],"teams":[{"slug":"docs","name":"Docs","org":"owner"}],"totalCount":2,"has_more":false}`, typed: `{"method":"reviewers","reviewers":{"users":[{"login":"octocat","avatar_url":""}],"teams":[{"slug":"docs","name":"Docs","org":"owner"}],"totalCount":2,"has_more":false}}`},
 	}
 	schema, err := uiGetOutputSchema().Resolve(nil)
 	require.NoError(t, err)

pkg/github/ui_tools.go

@@ -74,10 +74,6 @@ func UIGet(t translations.TranslationHelperFunc) inventory.ServerTool {
 			if err != nil {
 				return utils.NewToolResultError(err.Error()), &UIGetOutput{Method: "labels"}, nil
 			}
-			if compatibilityMethod, ok := args["_compat_method"].(string); ok {
-				method = compatibilityMethod
-			}
-
 			owner, err := RequiredParam[string](args, "owner")
 			if err != nil {
 				return utils.NewToolResultError(err.Error()), &UIGetOutput{Method: uiGetSchemaMethod(method)}, nil

ui/package.json

@@ -11,6 +11,7 @@
     "build": "node scripts/build.mjs",
     "dev": "npm run build",
     "typecheck": "tsc --noEmit",
+    "test": "node --experimental-strip-types --test src/lib/*.test.ts",
     "clean": "rm -rf dist"
   },
   "dependencies": {

ui/src/apps/issue-write/App.tsx

@@ -25,6 +25,7 @@ import {
 import { AppProvider } from "../../components/AppProvider";
 import { useMcpApp } from "../../hooks/useMcpApp";
 import { completedToolResult } from "../../lib/toolResult";
+import { parseUIGetResult } from "../../lib/uiGetResult";
 import { MarkdownEditor } from "../../components/MarkdownEditor";
 
 interface IssueResult {
@@ -552,7 +553,7 @@ function CreateIssueApp() {
             (c: { type: string }) => c.type === "text"
           );
           if (textContent && "text" in textContent) {
-            const data = JSON.parse(textContent.text as string);
+            const data = parseUIGetResult("labels", textContent.text as string);
             const labels = (data.labels || []).map(
               (l: { name: string; color: string; id: string }) => ({
                 id: l.id || l.name,
@@ -579,7 +580,7 @@ function CreateIssueApp() {
             (c: { type: string }) => c.type === "text"
           );
           if (textContent && "text" in textContent) {
-            const data = JSON.parse(textContent.text as string);
+            const data = parseUIGetResult("assignees", textContent.text as string);
             const assignees = (data.assignees || []).map(
               (a: { login: string }) => ({
                 id: a.login,
@@ -605,7 +606,7 @@ function CreateIssueApp() {
             (c: { type: string }) => c.type === "text"
           );
           if (textContent && "text" in textContent) {
-            const data = JSON.parse(textContent.text as string);
+            const data = parseUIGetResult("milestones", textContent.text as string);
             const milestones = (data.milestones || []).map(
               (m: { number: number; title: string; description: string }) => ({
                 id: String(m.number),
@@ -633,10 +634,8 @@ function CreateIssueApp() {
             (c: { type: string }) => c.type === "text"
           );
           if (textContent && "text" in textContent) {
-            const data = JSON.parse(textContent.text as string);
-            // ui_get returns array directly or wrapped in issue_types/types
-            const typesArray = Array.isArray(data) ? data : (data.issue_types || data.types || []);
-            const types = typesArray.map(
+            const typesArray = parseUIGetResult("issue_types", textContent.text as string);
+            const types = typesArray.filter(t => t !== null).map(
               (t: { id: number; name: string; description?: string } | string) => {
                 if (typeof t === "string") {
                   return { id: t, text: t };
@@ -663,7 +662,7 @@ function CreateIssueApp() {
             (c: { type: string }) => c.type === "text"
           );
           if (textContent && "text" in textContent) {
-            const data = JSON.parse(textContent.text as string);
+            const data = parseUIGetResult("issue_fields", textContent.text as string);
             const fields = (data.fields || [])
               .map(
                 (field: {

ui/src/apps/pr-edit/App.tsx

@@ -26,6 +26,7 @@ import {
 import { AppProvider } from "../../components/AppProvider";
 import { useMcpApp } from "../../hooks/useMcpApp";
 import { completedToolResult } from "../../lib/toolResult";
+import { parseUIGetResult } from "../../lib/uiGetResult";
 import { MarkdownEditor } from "../../components/MarkdownEditor";
 
 interface PRResult {
@@ -392,8 +393,8 @@ function EditPRApp() {
         if (result && !result.isError && result.content) {
           const textContent = result.content.find((c: { type: string }) => c.type === "text");
           if (textContent && "text" in textContent) {
-            const data = JSON.parse(textContent.text as string);
-            const branches = (data.branches || data || []).map(
+            const data = parseUIGetResult("branches", textContent.text as string);
+            const branches = (data.branches || []).map(
               (b: { name: string; protected?: boolean }) => ({ name: b.name, protected: b.protected || false })
             );
             setAvailableBranches(branches);
@@ -416,7 +417,7 @@ function EditPRApp() {
         if (result && !result.isError && result.content) {
           const textContent = result.content.find((c: { type: string }) => c.type === "text");
           if (textContent && "text" in textContent) {
-            const data = JSON.parse(textContent.text as string);
+            const data = parseUIGetResult("reviewers", textContent.text as string);
             const users = (data.users || []).map(
               (u: { login: string; avatar_url?: string }) => ({
                 kind: "user" as const,

ui/src/apps/pr-write/App.tsx

@@ -28,6 +28,7 @@ import {
 import { AppProvider } from "../../components/AppProvider";
 import { useMcpApp } from "../../hooks/useMcpApp";
 import { completedToolResult } from "../../lib/toolResult";
+import { parseUIGetResult } from "../../lib/uiGetResult";
 import { MarkdownEditor } from "../../components/MarkdownEditor";
 
 interface PRResult {
@@ -335,8 +336,8 @@ function CreatePRApp() {
         if (result && !result.isError && result.content) {
           const textContent = result.content.find((c: { type: string }) => c.type === "text");
           if (textContent && "text" in textContent) {
-            const data = JSON.parse(textContent.text as string);
-            const branches = (data.branches || data || []).map(
+            const data = parseUIGetResult("branches", textContent.text as string);
+            const branches = (data.branches || []).map(
               (b: { name: string; protected?: boolean }) => ({ name: b.name, protected: b.protected || false })
             );
             setAvailableBranches(branches);
@@ -363,7 +364,7 @@ function CreatePRApp() {
         if (result && !result.isError && result.content) {
           const textContent = result.content.find((c: { type: string }) => c.type === "text");
           if (textContent && "text" in textContent) {
-            const data = JSON.parse(textContent.text as string);
+            const data = parseUIGetResult("reviewers", textContent.text as string);
             const users = (data.users || []).map(
               (u: { login: string; avatar_url?: string }) => ({
                 kind: "user" as const,