feat(http): implement HeaderAllowedFeatureFlags for X-MCP-Features header validation

[mattdholloway]

Summary

Why

Fixes #

What changed

MCP impact

• No tool or API changes
• Tool schema or behavior changed
• New tool added

Prompts tested (tool changes only)

Security / limits

• No security or limits impact
• Auth / permissions considered
• Data exposure, filtering, or token/size limits considered

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
  • I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR

Note: if you're renaming tools, you must add the tool aliases. For more information on how to do so, please refer to the official docs.

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Docs

• Not needed
• Updated (README / docs / examples)

[Copilot]

Pull request overview

Implements a shared allowlist of feature flags that may be enabled via the X-MCP-Features HTTP header, and wires the HTTP server’s header validation to that allowlist.

Changes:

• Added github.HeaderAllowedFeatureFlags as the centralized allowlist for header-enabled feature flags.
• Updated the HTTP server feature-flag whitelist to use github.HeaderAllowedFeatureFlags (instead of an empty list).

Show a summary per file

File	Description
pkg/http/server.go	Uses the centralized allowlist for X-MCP-Features header validation in the HTTP feature checker.
pkg/github/tools.go	Introduces HeaderAllowedFeatureFlags listing which feature flags are permitted from X-MCP-Features.

Copilot's findings

Comments suppressed due to low confidence (1)

pkg/http/server.go:30

• knownFeatureFlags aliases the underlying slice backing github.HeaderAllowedFeatureFlags. Even if you keep the exported slice, it’s safer for the HTTP layer to work off a defensive copy so later mutations (or accidental sharing) can’t affect the allowlist used to build knownSet. Consider cloning the slice when assigning (or calling an accessor that returns a clone).

var knownFeatureFlags = github.HeaderAllowedFeatureFlags

• Files reviewed: 2/2 changed files
• Comments generated: 2