GitHub MCP server

Install

What it lets the assistant do

• Search code, commits and repositories Read search_code, search_commits and search_repositories run GitHub search across every repository the credential can see, private ones included. The matches are returned into the assistant’s context.
• Read files, branches, commits and releases Read get_file_contents, list_branches, list_commits, get_commit and list_releases belong to the repos toolset, which is on by default.
• Create, update, push and delete files Write create_or_update_file, push_files and delete_file each commit to the branch named in the call. The README lists both the repo and workflow OAuth scopes for push_files and delete_file.
• Create, fork and delete repositories Write create_repository makes a private repository when the private flag is left out. delete_repository needs the delete_repo scope; with a classic token the server hides any tool whose scope the token lacks.
• Open, edit and merge pull requests Write create_pull_request, update_pull_request, update_pull_request_branch and merge_pull_request. If a merge into a branch starts a deployment workflow, a merge made here starts it too.
• Review pull requests Write pull_request_review_write creates, submits and deletes reviews, and add_comment_to_pending_review adds line comments to your pending review.
• Read, create and comment on issues Write issue_read, list_issues and search_issues read. issue_write creates or updates issues, sub_issue_write changes sub-issues, and add_issue_comment posts comments on issues and pull requests.
• Read and trigger GitHub Actions Write The actions toolset is off by default. actions_list, actions_get and get_job_logs read workflows, runs and logs; actions_run_trigger runs workflow actions. Logs contain whatever a workflow printed.
• Read code scanning, Dependabot and secret scanning alerts Read The code_security, dependabot and secret_protection toolsets are off by default. Turn them on with --toolsets locally or the X-MCP-Toolsets header on the remote server.
• Browse a repository tree Read get_repository_tree in the git toolset returns the tree of a branch, tag or commit through the Git API, optionally recursive and filtered by path prefix, without cloning the repository.
• Read security advisories Read list_global_security_advisories filters GitHub’s advisory database by package, ecosystem, CVE or severity; list_repository_security_advisories reads advisories on your own repositories. These tools ask for the security_events scope.
• Manage rulesets and custom properties Write The governance toolset, off by default, can create repository rulesets and set custom properties at repository, organisation and enterprise level.
• Hand work to Copilot Write The copilot toolset has assign_copilot_to_issue and request_copilot_review. The hosted server adds Copilot Spaces tools and a search of GitHub’s support docs.
• Gists, discussions, projects, labels and notifications Write Optional toolsets that mix read tools with writes such as create_gist, discussion_comment_write, projects_write, label_write and mark_all_notifications_read.
• Call the GitHub API over the network Network The hosted server runs at api.githubcopilot.com. The local server is the ghcr.io/github/github-mcp-server container or a binary built from cmd/github-mcp-server, and it calls the GitHub API with your token.

Tools checked one by one against the repository README on 2026-10-15.

Before you connect it

1. 1Start read-only. Add the X-MCP-Readonly header, use https://api.githubcopilot.com/mcp/x/all/readonly, or pass --read-only locally. GitHub’s configuration guide says read-only mode disables every write tool, even one you request by name.
2. 2Load fewer tools. With no configuration the server loads the context, repos, issues, pull_requests and users toolsets. Name only the toolsets you need, and drop single tools such as merge_pull_request with --exclude-tools or X-MCP-Exclude-Tools.
3. 3Scope the token. The README’s token advice is minimum scopes, a separate token per project, regular rotation, and never committing a token. Limit any personal access token to the repositories you are working on.
4. 4Treat issue and pull request text as untrusted input. Lockdown mode (--lockdown-mode or X-MCP-Lockdown) only surfaces public-repository content from users with push access. GitHub calls it a best-effort filter against prompt injection, not an authorization boundary.
5. 5Keep tool confirmations on. The MCP tools specification says a human should be able to deny any tool call, and a merge, push or repository deletion made here uses your credential.
6. 6Prefer OAuth on the hosted server where your client supports it. With OAuth the server sends a scope challenge the first time a tool needs a scope you have not granted, instead of you granting every scope up front.
7. 7Use Insiders mode only on purpose. The /insiders URL, the X-MCP-Insiders header and the --insiders flag turn on experimental tools that GitHub says may change or be removed.
8. 8Protect the token on disk. For the local server the README suggests keeping the token in an environment variable, keeping .env files out of git, and restricting config files that hold a token, for example with chmod 600.
9. 9Plan for GitHub Enterprise Server. The README says Enterprise Server does not support the hosted endpoint, so it needs the local server and your own OAuth app or GitHub App.