chore: gh-host as oauth auth server

[atharva1051]

Summary

Conditionally set AuthorizationServer only when --gh-host is explicitly provided, ensuring github.com users receive the correct default.

Why

To ensure that OAuth protected resource metadata correctly exposes the authorization server endpoint for all clients, including those using github.com where cfg.Host might be empty. This conditional setting prevents an invalid AuthorizationServer value and ensures proper discovery of authentication details.

What changed

• pkg/http/server.go: AuthorizationServer is now only overridden when cfg.Host != "". Otherwise, it falls back to DefaultAuthorizationServer (https://github.com/login/oauth).

MCP impact

• No tool or API changes

Prompts tested (tool changes only)

N/A

Security / limits

• Auth / permissions considered — OAuth authorization server URL now correctly resolves for both github.com and GHES

Tool renaming

• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Docs

• Not needed

The program was tested solely for our own use cases, which might differ from yours.

Atharva Patil <atharva.a.patil@mercedes-benz.com> on behalf of Mercedes-Benz Research And Development India, Provider Information

[Copilot]

Pull request overview

Adjusts HTTP-mode OAuth protected resource metadata so the authorization server URL is only overridden when --gh-host is explicitly provided, allowing github.com users to fall back to the built-in default authorization server.

Changes:

• Conditionally set oauthCfg.AuthorizationServer only when cfg.Host != "" (otherwise rely on oauth.NewAuthHandler’s default).
• Avoid generating an invalid authorization server value when cfg.Host is empty.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[arhiv1973b]

LGTM! ✅

[atharva1051]

Hello @SamMorrowDrums or @omgitsads ,

Could you please review this once?

Thank you

[omgitsads]

Hi @atharva1051, thanks for raising this issue. I think theres some additional complexity around handling GHES for both http/https, so not quite as simple as just putting the cfg.Host in.

Like I said in the review, I think a better place to make this decision is in during the url resolution in the APIHostResolver implementation, then passing the resolver into the OAuth Handler. I put together a quick PR of that, but happy to make those changes here so that your contribution is not just dismissed.

[atharva1051]

Oh that would be really helpful, although i did end up making few changes the moment I saw your comment.
But I got the idea. Thanks :) Do also re-review my changes for learning purposes.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

[atharva1051]

@omgitsads made the changes you made in #2070
Thanks again