hermes - 💡(How to fix) Fix feat: streamline GitHub MCP OAuth device code flow

Problem

Setting up the GitHub MCP server at api.githubcopilot.com/mcp/ requires: creating a custom OAuth app, manually executing the device code flow via curl or script, opening a browser to enter a code, and writing the token to config.yaml by hand. The token expires in ~8h with no auto-refresh, so this friction repeats.

Proposed Solution: hermes setup github-mcp command

Hermes should offer an integrated workflow:

1. Register or configure an OAuth app client ID (bundled default or user-provided)
2. Request device code via POST https://github.com/login/device/code
3. Use Hermes' browser tool to auto-navigate to the verification page and enter the code
4. Poll for token via POST https://github.com/login/oauth/access_token
5. Auto-write the Bearer token to config.yaml under mcp_servers.github
6. Verify the MCP server responds

Auto-refresh path

Since GitHub's device code grant doesn't issue refresh tokens, the command should either:

• Schedule a cron job reminder every 6-7h to re-auth
• Intercept 401 responses and trigger re-auth on the fly

Copilot token exchange

If the user has a Copilot subscription, exchange the raw token for a longer-lived API token via /copilot_internal/v2/token. If it returns 404 (no Copilot sub), fall back to the raw gho_* token — sufficient for most MCP operations.

Scopes needed

Minimum: read:user. For writes (issues, PRs, files): repo,read:user,workflow,admin:org.

Tested

Device code flow verified end-to-end on Linux with a custom OAuth app using scopes repo,read:user,workflow,admin:org.