fix(security): enforce HTTPS for gh-host/GITHUB_HOST to prevent cleartext credentials

[SamMorrowDrums]

Closes github/copilot-mcp-core#1815

The problem

The MCP server accepts an enterprise host via the --gh-host flag / GITHUB_HOST env var. For GitHub Enterprise Server (GHES) hosts, a non-HTTPS (http://) scheme was accepted and interpolated into every derived URL — REST, GraphQL, upload, raw, and the authorization server (fmt.Sprintf("%s://%s/api/v3/", u.Scheme, u.Hostname()), etc.). checkSubdomainIsolation also probed over that scheme.

The result: outbound authenticated requests could carry the bearer token / PAT over cleartext HTTP, exposing it to network interception and replay. newGHECHost already rejected http, but newGHESHost did not.

The fix

Enforce HTTPS centrally in parseAPIHost, so no deployment (GHES included) can ever build authenticated URLs over cleartext, and the behavior is consistent with the existing GHEC rejection — without duplicating logic per host type.

Loopback exception

http is permitted only for loopback hosts (localhost, 127.0.0.1, ::1) so local/dev testing against a dev server still works. This is implemented narrowly via an exact-match isLoopbackHost check and documented with a comment explaining why. Empty-scheme inputs are still rejected as before.

Rejection produces a clear, security-oriented error:

host must use https to avoid sending credentials over cleartext: http://ghe.example.com (http is only permitted for loopback hosts such as localhost, 127.0.0.1, or ::1)

Tests

• pkg/utils/api_test.go: https GHES accepted (unchanged); http GHES rejected with the security error; http loopback accepted (localhost and 127.0.0.1); http remote host rejected; empty-scheme still rejected; dotcom/GHEC unchanged.
• pkg/http/oauth/oauth_test.go: the pre-existing case that asserted http GHES was accepted now asserts it is rejected — that test previously codified the vulnerable behavior.

Docs

Reworded the GHES note in README.md: HTTPS is now required/enforced (loopback excepted) rather than "otherwise defaults to http://".

Validation

go build ./..., go test -race ./..., and golangci-lint (via script/lint, 0 issues) all pass. script/generate-docs produces no additional diff. The change is surgical — no unrelated refactoring.

[Copilot]

Pull request overview

Enforces HTTPS for configured GitHub hosts while retaining a loopback exception for local development.

Changes:

• Adds centralized scheme validation.
• Updates host and OAuth tests.
• Documents the HTTPS requirement.

Show a summary per file

File	Description
README.md	Documents HTTPS enforcement and loopback exception.
pkg/utils/api.go	Validates schemes before constructing API URLs.
pkg/utils/api_test.go	Tests HTTP rejection and loopback acceptance.
pkg/http/oauth/oauth_test.go	Verifies insecure GHES OAuth hosts are rejected.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced