[eric] integrations: add GitHub MCP (remote http server + one-click OAuth)

(cherry picked from commit 901e3bf98244d3e599db5f3f05f4dc2ce943888e)

backend/apps/agents/agent_manager.py

@@ -200,8 +200,9 @@ class AgentManager:
                 continue
 
             if tool.auth_type == "oauth2" and tool.auth_status == "connected":
-                if tool.name.lower() == "discord":
-                    # Discord uses a shared bot token from .env, not user OAuth tokens.
+                if tool.name.lower() in ("discord", "github"):
+                    # Discord uses a shared bot token; GitHub OAuth-app tokens don't
+                    # expire and carry no refresh_token. Nothing to refresh either way.
                     refreshed = True
                 elif tool.name.lower() == "airtable":
                     refreshed = await refresh_airtable_token(tool)

backend/apps/agents/core/mcp_preflight.py

@@ -56,6 +56,11 @@ CURATED_SHORTLIST: list[CuratedEntry] = [
         "title": "Airtable",
         "description": "Read and write records, manage bases, tables, and fields in the user's Airtable.",
     },
+    {
+        "id": "GitHub",
+        "title": "GitHub",
+        "description": "Repos, issues, pull requests, Actions, code search, gists; when the task involves the user's GitHub.",
+    },
     {
         "id": "Reddit",
         "title": "Reddit",

backend/apps/tools_lib/oauth_tokens.py

@@ -27,6 +27,7 @@ _TOOL_NAME_TO_PROVIDER = {
     "hubspot": "hubspot",
     "discord": "discord",
     "notion": "notion",
+    "github": "github",
     # Built-in Google tool's name is "Google Workspace"; accept the bare
     # "google" alias too for forward compatibility.
     "google workspace": "google",
@@ -61,6 +62,12 @@ def _persist_cloud_tokens(tool: ToolDefinition, tokens: dict) -> None:
     elif name == "notion":
         tool.oauth_tokens = {"access_token": tokens.get("access_token", "")}
         tool.connected_account_email = tokens.get("workspace_name", "Notion workspace")
+    elif name == "github":
+        # GitHub OAuth-App tokens don't expire and carry no refresh_token, so
+        # store the bare token; the cloud callback enriches `login` for the label.
+        tool.oauth_tokens = {"access_token": tokens.get("access_token", "")}
+        login = tokens.get("login")
+        tool.connected_account_email = f"@{login}" if login else ""
     else:
         tool.oauth_tokens = {
             "access_token": tokens.get("access_token", ""),

frontend/src/app/pages/Tools/integrations.tsx

@@ -50,6 +50,20 @@ export const INTEGRATIONS: Integration[] = [
       </svg>
     ),
   },
+  {
+    id: 'github',
+    name: 'GitHub',
+    description: 'Repos, issues, pull requests, Actions, code search, and gists. Connects with your GitHub account.',
+    mcp_config: { type: 'http', url: 'https://api.githubcopilot.com/mcp/' },
+    color: '#181717',
+    website: 'https://github.com/github/github-mcp-server',
+    icon: (
+      <svg viewBox="0 0 24 24" width="22" height="22">
+        <path d="M12 .5C5.73.5.5 5.73.5 12c0 5.08 3.29 9.39 7.86 10.91.58.11.79-.25.79-.56 0-.28-.01-1.02-.02-2-3.2.7-3.88-1.54-3.88-1.54-.53-1.34-1.29-1.7-1.29-1.7-1.05-.72.08-.71.08-.71 1.16.08 1.77 1.19 1.77 1.19 1.03 1.77 2.7 1.26 3.36.96.1-.75.4-1.26.73-1.55-2.55-.29-5.24-1.28-5.24-5.69 0-1.26.45-2.29 1.19-3.1-.12-.29-.52-1.46.11-3.05 0 0 .97-.31 3.18 1.18a11.02 11.02 0 0 1 5.8 0c2.2-1.49 3.17-1.18 3.17-1.18.63 1.59.23 2.76.11 3.05.74.81 1.19 1.84 1.19 3.1 0 4.42-2.69 5.39-5.25 5.68.41.36.78 1.06.78 2.14 0 1.55-.01 2.8-.01 3.18 0 .31.21.68.8.56A11.51 11.51 0 0 0 23.5 12C23.5 5.73 18.27.5 12 .5z" fill="#181717"/>
+      </svg>
+    ),
+    authType: 'oauth2',
+  },
   {
     id: 'google-workspace',
     name: 'Google Workspace',