GitHub MCP Server
Give AI assistants natural-language access to GitHub repositories and collaboration workflows.
- Source repo
- github/github-mcp-server
- Stars
- ★ 34k
- Last updated
- 1d ago
- License
- MIT
- Primary language
- Go
- FA score
- 67/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex · Claude Code
- Cost
- Free, no paid service needed
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A maintainer wants to search repository files, inspect commits, and map project structure from an AI host.
- Not a fit if
- Teams that need to work with GitHub data fully offline
- Users who need read-only access but do not want to configure tool permissions
- Source review
- 67/100 · Some gaps
What does this agent do, and when should you use it?
GitHub MCP Server is GitHub's MCP service for connecting compatible AI tools to the GitHub platform. It runs as the github-mcp-server command, a Docker container, or GitHub-hosted remote endpoint, exposing tools, resources, and prompts to MCP clients. Its capabilities cover repository and code lookup, issues and pull requests, GitHub Actions, discussions, notifications, team information, and security alerts. Available toolsets can be configured, and --read-only skips write tools. The remote service requires a host that supports remote MCP; local deployment uses Docker or a Go source build and authenticates with OAuth or a GitHub Personal Access Token.
An MCP client connects to the remote https://api.githubcopilot.com/mcp/ endpoint or starts a local github-mcp-server; the service authenticates with OAuth or GITHUB_PERSONAL_ACCESS_TOKEN and calls GitHub APIs. Clients can query repository files, directories, and commits; manage issues, pull requests, discussions, and Gists; inspect Actions workflows and runs; read Dependabot and code scanning alerts; and perform write or workflow-trigger operations when the relevant tools are enabled. Results are returned as MCP tool responses, with structured output available for some tools on supported protocol versions.
- A maintainer wants to search repository files, inspect commits, and map project structure from an AI host.
- A project team wants to create or update issues, pull requests, and discussion comments using natural language.
- A CI owner needs to inspect Actions workflow runs, job logs, build failures, and artifacts.
- A security team needs to query Dependabot, code scanning, or security advisory information.
- A GitHub administrator needs to inspect team members, organization details, rulesets, or custom properties.
How do you install or deploy this agent?
Choose GitHub's hosted remote server or run the local version. Remote use requires a compatible MCP host; the local container option requires Docker to be installed and running. On GitHub.com, browser-based OAuth is available, or you can provide a PAT through GITHUB_PERSONAL_ACCESS_TOKEN.
VS Code configuration for the remote server:
{
"servers": {
"github": {
"type": "http",
"url": "https://api.githubcopilot.com/mcp/"
}
}
}Example local Docker configuration:
{
"mcp": {
"servers": {
"github": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-p",
"127.0.0.1:8085:8085",
"-e",
"GITHUB_OAUTH_CALLBACK_PORT",
"ghcr.io/github/github-mcp-server"
],
"env": {
"GITHUB_OAUTH_CALLBACK_PORT": "8085"
}
}
}
}
}You can also build the Go binary from a checkout:
go build -o github-mcp-server ./cmd/github-mcp-serverHow do you use this agent?
Add the server configuration to an MCP-capable host and start the GitHub server there. The remote VS Code setup requires version 1.101 or later; after configuration, switch Copilot Chat to Agent mode. Control tool groups with GITHUB_TOOLSETS or --toolsets, and select individual tools with GITHUB_TOOLS or --tools. When none are specified, the defaults are context, repos, issues, pull_requests, and users.
Example local PAT configuration:
{
"mcp": {
"servers": {
"github": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"GITHUB_PERSONAL_ACCESS_TOKEN",
"ghcr.io/github/github-mcp-server"
],
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "${input:github_token}"
}
}
}
}
}After building from source, start it with github-mcp-server stdio; provide a PAT and toolset configuration as needed.
What are this agent's strengths and limitations?
- Offers both GitHub-hosted remote access and local operation, with OAuth or PAT authentication.
- Toolsets can be selected, individual tools can be specified, and read-only mode is available.
- Covers repository, collaboration, Actions, organization, and several GitHub security workflows.
- Supports local configuration for GitHub Enterprise Server and ghe.com.
- Available operations depend on the permissions granted to the OAuth session or PAT.
- The remote server requires a remote-MCP-capable client; GitHub Enterprise Server does not support remote hosting.
- The local container requires Docker, while building from source requires Go.
- OAuth for many hosts requires the host to configure a GitHub App or OAuth App, with setup varying by host.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| GitHub MCP Server This agent | 67 · Some gaps | MCP serverFree | ★ 34k | 1d ago | Go | Codex · Claude Code |
| Helmor Local Agent Workbench | 52 · Major gaps | Desktop appFree + model costs | ★ 1.3k | 2mo ago | TypeScript | Codex · Claude Code |
| TAKT Workflow Orchestrator | 57 · Major gaps | CLIFree + model costs | ★ 1.4k | today | TypeScript | Codex · Claude Code · OpenAI API · Claude API |
| Loop Engineering | 69 · Some gaps | CLIFree + model costs | ★ 12k | today | TypeScript | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
The documentation recommends limiting PAT scopes, supports read-only mode and toolset allow-lists, and says local OAuth tokens remain in memory. This supports least privilege and reasonable sensitive-data handling, but details on data handling by the hosted service are limited. Write capabilities such as creating repositories, pushing files, and triggering workflows are documented, while the supplied evidence does not show a consistent per-action user confirmation mechanism. General safeguards for external effects and rollback are also sparse, so those scores are low. go.mod lists dependencies, but the supplied material contains no security audit or mitigation evidence. The README, LICENSE, and SECURITY.md clearly establish GitHub attribution, MIT licensing, and a vulnerability reporting path, warranting full source-attribution credit.
The README, installation guides, and configuration documentation cover multiple setup paths and troubleshooting, but the supplied material contains potentially inconsistent or incomplete details: for example, the module-path note refers to a correction awaiting release, and token-variable names and configuration examples are not fully uniform across guides. Self-consistency therefore receives partial credit. go.mod pins direct dependency versions, but there is no evidence here about availability or graceful degradation. The Claude and Cline guides give concrete symptoms, causes, and remedies, though the evidence is insufficient to establish adequate error reporting across all paths. This static review does not assess runtime results.
The documentation targets developers and AI assistants across several MCP hosts and lists repository, issue, PR, Actions, security-analysis, and collaboration scenarios. Toolset and individual-tool configuration, read-only mode, remote and local deployment, and enterprise-host support show useful configurability; however, the supplied material does not provide a complete capability-permission matrix, and some host behavior depends on host support. The README states MCP host, version, and transport prerequisites, while platform-specific guides provide tailored configuration and limitations, supporting a strong environment-fit score.
The README separates remote and local installation, authentication, tool configuration, and build guidance, with dedicated host guides; the structure is useful but lengthy and repetitive. Install prerequisites, examples, and troubleshooting are thorough. Tool names, parameters, and version paths receive some documentation, though examples across hosts and backward-compatibility notes do not establish uniform stability. Examples and troubleshooting cover many common situations. Known limitations include the stated Claude Desktop remote-connection constraint, but the supplied material is not a complete limitations list. LICENSE clearly specifies MIT. The README explains version identifiers and module-path details, but the supplied material does not include a complete release changelog. SECURITY.md, the README, and the stated official-organization provenance clearly identify maintenance responsibility and a security-reporting path.
The server exposes GitHub API capabilities through MCP tools, and the README's repository, issue, PR, workflow, and collaboration use cases indicate substantial marginal value. Toolset and individual-tool filtering can limit context size, but the supplied material does not fully explain the cost-benefit trade-offs of defaults and permission configurations. The documentation provides actionable setup examples and use cases; it does not provide enough evidence to assess the practical usability of tool results across tasks.
Some README feature and setup claims are reflected in multiple host-specific guides, while LICENSE and SECURITY.md independently support licensing and reporting details. However, the supplied material contains no implementation code or tool definitions, so many capability and security claims cannot be traced to code. Cross-source support exists, but repeated descriptions across guides are not independent validation. The documentation distinguishes prerequisites, limitations, and recommendations, yet some security and compatibility statements remain explanatory claims rather than facts independently verifiable from this material, so full credit is not justified.
- The server exposes write-capable GitHub operations. Before deployment, enable read-only mode or restrict available toolsets, and limit PAT permissions to those required for the task.
- The supplied material includes no implementation code or runtime evidence, so specific tool behavior, hosted-service data handling, and actual error handling could not be verified.
FAQ
Should I use the remote or local server?
Do I have to use a Personal Access Token?
GITHUB_PERSONAL_ACCESS_TOKEN is set, the server uses the PAT in preference to OAuth.How can I limit what the AI tools can do?
--toolsets or GITHUB_TOOLSETS, choose individual tools with --tools or GITHUB_TOOLS, and use --read-only to skip write tools.Can it connect to a remote GitHub Enterprise Server endpoint?
--gh-host or GITHUB_HOST.