GitHub MCP Server: GitHub's Official MCP Server for Agents

What the GitHub MCP Server is

The GitHub MCP Server is GitHub's official Model Context Protocol server. It connects AI tools to the GitHub platform so that agents, assistants and chatbots can read repositories and code files, manage issues and pull requests, analyse code and automate workflows through natural-language requests. Any MCP host that speaks the protocol, such as VS Code with Copilot, Claude Desktop, Cursor, Windsurf or Zed, can use it as a tool provider.

The problem it addresses is the gap between a coding agent and the place where a team's work actually lives. An agent that can edit files locally still needs to look up an issue, read a failing GitHub Actions run, check Dependabot alerts or open a pull request. Instead of every host shipping its own GitHub integration, the server exposes those operations as MCP tools, resources and prompts with one consistent interface. The README lists the intended use cases as repository management, issue and PR automation, CI/CD and workflow intelligence, code analysis of security findings, and team collaboration through discussions and notifications.

It is written in Go, licensed under MIT, and maintained in the github/github-mcp-server repository. The Go module path is github.com/github/github-mcp-server/v2.

How it works: remote and local servers

The project ships in two forms. The remote GitHub MCP Server is hosted by GitHub at https://api.githubcopilot.com/mcp/. It is the quickest way to start: a host that supports remote MCP servers connects over HTTP and authenticates with OAuth or a personal access token. The README notes that VS Code needs version 1.101 or later for remote MCP and OAuth support, and that each host must register its own GitHub App or OAuth App to use OAuth, while PAT authentication should work with any host that supports remote servers.

The local GitHub MCP Server runs on the developer's machine, usually as the public Docker image ghcr.io/github/github-mcp-server speaking stdio, or as a binary built from source with go build. On github.com the official image includes app credentials, so it can run a browser-based OAuth login on first use and keep the resulting token in memory only. The Docker variant publishes a fixed loopback callback port so the container's login callback is reachable. A GITHUB_PERSONAL_ACCESS_TOKEN environment variable takes precedence over OAuth when set.

Functionality is grouped into toolsets. Each toolset bundles the tools, resources and prompts for one area of GitHub: repos, issues, pull_requests, actions, code_security, dependabot, discussions, gists, git, governance, labels, notifications, orgs, projects, secret_protection, security_advisories, stargazers, users and more. When nothing is specified the server loads a default set of context, repos, issues, pull_requests and users. The remote server adds toolsets the local one does not have, including Copilot coding agent tools, Copilot Spaces and a GitHub support docs search.

Key features

• Toolset and tool allow-lists: the --toolsets and --tools flags (or GITHUB_TOOLSETS and GITHUB_TOOLS) restrict what the model sees, which the README says helps tool choice and reduces context size. Invalid tool names stop the server at startup.
• Read-only mode: --read-only exposes only read tools, and it wins over any write tool requested explicitly.
• Lockdown mode: a best-effort filter that hides or rejects public-repository content written by users without push access, intended to reduce prompt-injection risk from issues, PRs and comments. The README is clear that it is not an authorization boundary.
• OAuth login without stored secrets: the local server can log in through the browser and keep the token in memory, with a device-code fallback for headless use and GitHub App authentication for non-interactive stdio deployments.
• GitHub Enterprise support: --gh-host or GITHUB_HOST points the local server at GitHub Enterprise Server or a ghe.com data-residency tenant; non-HTTPS hosts are refused except loopback.
• Insiders mode: an opt-in channel with early access to experimental tools, available on both the remote and local server.
• Description overrides and i18n: tool descriptions, server name and title can be overridden via a github-mcp-server-config.json file or GITHUB_MCP_-prefixed environment variables, useful when running separate instances for github.com and GHES.

Getting started

For the hosted server in VS Code, the README's minimal configuration is a single HTTP entry:

{
  "servers": {
    "github": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp/"
    }
  }
}

To run the local server with Docker and a token, restricting it to a few toolsets:

docker run -i --rm \
  -e GITHUB_PERSONAL_ACCESS_TOKEN=<your-token> \
  -e GITHUB_TOOLSETS="repos,issues,pull_requests,actions,code_security" \
  ghcr.io/github/github-mcp-server

Claude Code users can register it from the CLI, as shown in the README's token-handling section:

claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=$GITHUB_PAT -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server

Without Docker, build the binary from a checkout and run it with read-only tools only:

go build -o github-mcp-server ./cmd/github-mcp-server
./github-mcp-server --read-only

Per-host guides in the repository cover Copilot CLI, JetBrains and other Copilot IDEs, Claude Desktop and Claude Code, Codex, Cursor, Gemini CLI, OpenCode, Windsurf and Zed.

Use cases

• Issue triage from the editor: an agent reads new issues, labels them and drafts replies without leaving the IDE.
• CI failure analysis: with the actions toolset the model can inspect workflow runs and logs for a failing build and suggest a fix.
• Security review: the code_security, dependabot and secret_protection toolsets let an assistant summarise open code-scanning, dependency and secret-scanning alerts for a repository.
• Pull request workflows: create branches and pull requests, read diffs and review comments, or hand a task to the Copilot coding agent through the remote server.
• Enterprise deployments: run a local instance against GitHub Enterprise Server with a scoped token and a renamed server so agents can tell it apart from a github.com instance.

How it compares

Most MCP hosts can reach GitHub in other ways: a general shell tool running the gh CLI, a host's built-in GitHub integration, or community MCP servers. The distinguishing points here are that it is maintained by GitHub itself, that it exposes a large, documented catalogue of typed tools grouped into toolsets, and that it offers a hosted endpoint, so there is nothing to run locally for github.com users. Shell-based approaches give the model broader, less structured access; this server trades that for explicit tool definitions plus controls such as read-only and lockdown modes. Which is better depends on how much freedom the agent should have.

Things to know before adopting

• Token scope is the real boundary: the server can call many GitHub APIs, so the README recommends granting only the permissions the AI tool needs, using separate tokens per project, rotating them and never committing them. Lockdown mode filters content but does not reduce what the credential can do.
• Prompt injection: issues, PR bodies and comments in public repositories are untrusted input to the model. Read-only and lockdown modes exist for this reason.
• Remote vs local features: the Copilot, Copilot Spaces and support-docs toolsets are listed as remote-only. GitHub Enterprise Server cannot use the hosted endpoint and needs the local server.
• Library stability: the exported Go API is described as unstable and subject to breaking changes, and the README notes the original v2.0.0 tag cannot be used as a Go module because of a module-path correction.
• Host differences: configuration syntax and environment-variable support vary between MCP hosts; some require hard-coded tokens in config files.
• Licence: MIT, which permits commercial use, modification and redistribution with attribution.

Project activity

As of October 2026 the repository has about 33,700 stars. It was created in March 2025, is written in Go and is licensed under MIT, with commits landing as recently as mid-October 2026. Contribution, support and security policies are in the repository. Source, installation guides and the full tool reference are at github.com/github/github-mcp-server.