GitHub MCP Server
github.com/github/github-mcp-server- Category
- Developer Tools
- Rank
- No. 341Tools index
- Listed in
- #4 Connect tools with MCP
- Pricing
- Free
- Type
- TOOL
- Builder
- github
- GitHub
- 32.3k stars
- Latest release
- v1.9.0
- Added
- Jul 4, 2026
About
GitHub's official MCP server connects any coding agent to GitHub — repositories, issues, pull requests, Actions, code search, and security alerts — through the Model Context Protocol. The single most widely-used MCP server.
What it does
This server lets an AI assistant act on GitHub through natural-language requests. It translates those requests into authenticated repository browsing, code analysis, issue and pull request management, workflow monitoring, release work, security inspection, discussions, notifications, prompts, and resources.
Why it's ranked here
The project combines broad GitHub coverage with unusually flexible deployment and access control. Users can choose GitHub-hosted HTTP service or local operation, authenticate several ways, restrict tools and writes, and target enterprise installations. The supplied tests also exercise difficult authorization branches and installation-token behavior.
What's good
Security and control receive concrete treatment. Read-only mode caps permissions, exclusions override enabled tools, token scopes can hide unavailable operations, and lockdown mode adds repository access checks. OAuth state validation guards callbacks, local native callbacks bind to loopback, and GitHub App tokens are cached and refreshed before expiry.
Tradeoffs
Remote use depends on host-specific MCP and authentication support, with OAuth setup varying between applications. GitHub Enterprise Server cannot use remote hosting and must run locally. Local containers require Docker, while some hosts may require tokens directly in configuration. Experimental insiders features are explicitly early-access tools.
How to use it well
Use it when an agent needs recurring GitHub context plus controlled actions across code review, triage, automation, and pipeline investigation. Start with read-only mode and narrow toolsets or token scopes, then permit writes deliberately. It does not provide the agent or MCP host itself; you must bring a compatible client.
Technical notes+
The module in go.mod targets Go 1.25.12 and depends on the Go MCP SDK, Cobra, Chi, REST and GraphQL GitHub clients, OAuth2, and Testify. pkg/http/server.go builds the HTTP transport with Chi, OAuth metadata routes, configurable binding, graceful shutdown, tool filtering, feature flags, and scope challenges. pkg/github/server.go registers a static inventory of tools, prompts, resources, completions, middleware, and optional embedded UI resources. internal/ghmcp/server.go constructs REST, GraphQL, and raw-content clients and supports stdio operation. internal/ghmcp/oauth.go selects legacy server elicitation or modern multi-round-trip authorization according to the negotiated protocol. internal/oauth/callback.go validates OAuth state and limits native callbacks to loopback. internal/ghmcp/oauth_test.go and internal/githubapp/githubapp_test.go cover authorization branches, JWT signing, token caching, refresh, validation, and error handling.
Observed
- Primary language
- Go, using module-based dependency management
- Packaging and install surface
- GitHub-hosted remote service or public container image at ghcr.io/github/github-mcp-server
- Interfaces
- Model Context Protocol over remote HTTP or local stdio
- Authentication
- OAuth, personal access tokens, dynamic token providers, and GitHub App installation tokens
- Client support documented
- VS Code, Visual Studio, Claude applications, Codex, Cursor, OpenCode, Windsurf, Zed, Copilot CLI, and Rovo Dev CLI
- Enterprise support
- Remote service for Enterprise Cloud with data residency; local server required for GitHub Enterprise Server
- Access controls
- Read-only mode, enabled and excluded tools, toolsets, token-scope filtering, and lockdown mode
- Test structure
- Repository text includes Go tests for OAuth middleware and GitHub App token handling
Read from README.md, go.mod, pkg/http/server.go, pkg/github/server.go, internal/ghmcp/oauth.go, internal/ghmcp/server.go, internal/oauth/callback.go, internal/ghmcp/oauth_test.go, internal/ghmcp/server_test.go, internal/githubv4mock/query.go, internal/buildinfo/buildinfo.go, internal/githubapp/githubapp.go, internal/githubapp/githubapp_test.go.
Tags
Tech Stack
Comments (0)
No comments yet
Indexed by a proprietary survey. Corrections welcome.