A Copilot agent uses the GitHub MCP server to search issues and read pull request metadata across a single public repository. During OAuth authorization, the developer requests the 'repo' scope. A security engineer flags this as excessive. What is the minimum OAuth scope set that satisfies the agent's stated requirements?

GitHub's OAuth scopes follow a hierarchical model where broader scopes include all permissions of narrower ones. The 'repo' scope grants full read/write access to all repositories the user has access to, including private repositories. Requesting it for an agent that only reads public data violates least privilege in two ways: it grants write access when only read is needed, and it grants access to private repositories when only a public repository is needed.

For this use case: - Searching issues: available via the public issues API with no token for public repos, or 'public_repo' for consistency - Reading pull request metadata: available via the pulls API with 'public_repo' for public repositories

The correct minimum scope is 'public_repo', which grants read/write access to public repositories only. Since the agent only reads, the write capability within 'public_repo' is an acceptable residual risk that should be further mitigated by tool allow-listing (so the agent cannot call write-capable tools even with that scope).

Option A is incorrect: 'repo' is not the minimum for public repositories; 'public_repo' is a narrower alternative. Option C is incorrect: 'read:org' grants access to organization membership and team data, not repository content; 'read:user' grants access to user profile data. Neither provides repository issue or PR access. Option D is incorrect: 'admin:repo_hook' is for managing webhooks, not reading issues or PRs, and is a high-privilege scope that would be dangerous to grant unnecessarily.