What is GitHub MCP Server? Setup, token scopes, read-only mode and security
You ask your assistant about a repository, an issue or a pull request (PR); GitHub MCP Server reads repositories and code, manages issues and PRs, monitors Actions runs and reviews security alerts. It is the official MCP server built by GitHub itself (MIT); you use it either as a remote server hosted by GitHub (no installation) or as a local server running on your own machine (Docker). GitHub Docs states the server is available to all GitHub users regardless of plan type. It also has write and destructive tools (deleting files, deleting repositories, merging PRs, triggering workflows); read-only mode turns them off. The main risk: issue and PR text in public repositories can look like instructions to the assistant (prompt injection).
- What it does
- Has your assistant do repository, issue, PR and Actions work on GitHub
- Type
- MCP server (remote, hosted by GitHub; or local Docker)
- Where
- Claude Code, VS Code, Cursor, Codex, Gemini CLI and more
- Authentication
- Personal access token (PAT) or OAuth
- Does it write?
- Yes, including destructive tools; read-only mode available
- Turkish
- Not stated in official sources
- Cost
- The server is free (MIT); no plan differences
What does GitHub MCP Server do?
MCP is the standard that lets AI programs connect to outside tools. With this server you can have your assistant work directly on GitHub: read a repository's files and history, search code, open and review issues and pull requests, read Actions run logs, and go through code scanning, Dependabot and secret scanning alerts.
Authentication: personal access token (PAT) or OAuth. There are write and destructive tools; read-only mode turns them off.
The tools are split into groups called "toolsets" (context, repos, issues, pull_requests, actions and others). Only some are on by default: context, repos, issues, pull_requests and users (about 45 tools). The README lists 92 tools in total; the remote server has 4 more, for 96. The Actions and security toolsets are off by default.
Who it is for: developers who work on GitHub and want to speed up repository, issue and PR work with an assistant. If you don't write code, it won't help you.
How do you set up GitHub MCP Server?
The official guide presents the remote server as "the easiest way to get started" (https://api.githubcopilot.com/mcp/). The local server is for clients without remote MCP support, GitHub Enterprise Server and customization; it needs Docker. For authentication, a personal access token (PAT) works in every client. The README recommends a fine-grained token. The commands are taken verbatim from the official guide.
› claude mcp add-json github '{"type":"http","url":"https://api.githubcopilot.com/mcp","headers":{"Authorization":"Bearer YOUR_GITHUB_PAT"}}'Then restart Claude Code and check with claude mcp list. If add-json returns "Invalid input" on Windows, the guide suggests the older form:
› claude mcp add --transport http github https://api.githubcopilot.com/mcp -H "Authorization: Bearer YOUR_GITHUB_PAT"The --transport http command on the atlas card is only for older versions; for 2.1.1 and later the guide gives the add-json form. For scope, use --scope local (default), project (shared with the team via .mcp.json) or user.
› claude mcp add github -e GITHUB_OAUTH_CALLBACK_PORT=8085 -- docker run -i --rm -p 127.0.0.1:8085:8085 -e GITHUB_OAUTH_CALLBACK_PORT ghcr.io/github/github-mcp-serverOn the local server, the official image offers browser-based OAuth sign-in for github.com; the token is kept in memory only. To use a PAT instead, the guide gives a separate command with an environment variable; an open issue (#3032) reports that this command fails with "unknown option -e".
!Official guide: the remote GitHub server cannot be added via Settings then Connectors then Add custom connector, because it requires an OAuth registration with GitHub, which is not supported at the moment. Use the local Docker setup; compatibility issues with Docker-based servers have also been reported.
For a local setup, add an mcpServers entry with the docker command to claude_desktop_config.json via Settings then Developer then Edit Config; the JSON is in the guide.
The official repository has a separate installation guide for each client: VS Code (1.101 and later), Cursor (v0.48.0+, the remote server needs a PAT), Codex (config.toml, PAT from an environment variable), Gemini CLI, Windsurf (PAT only), Zed, OpenCode, Visual Studio, JetBrains, Xcode, Eclipse. There are also guides for Rovo Dev CLI, Cline, Roo Code and Antigravity; for the commands, see the relevant guide in the official repository.
Start read-only: on the local server use --read-only or GITHUB_READ_ONLY=1; on the remote server use the /readonly URL or the X-MCP-Readonly header.
How do you use GitHub MCP Server?
Once it is set up, you write your request in plain language. For anything that requires writing, ask the assistant to tell you first what it is going to do.
In a client that asks for approval on every tool call, keep approval on, especially for delete, merge and push tools.
Which programs does GitHub MCP Server work in?
| Claude CodeYes | Remote (PAT) or local Docker; the command depends on the version. |
|---|---|
| Claude DesktopPartly | The remote server can't be added as a custom connector; local Docker is used. |
| VS Code (Copilot), Visual Studio, JetBrains, Xcode, EclipseYes | Through Copilot settings; some require Copilot access. |
| Cursor, Windsurf, Zed, OpenCodeYes | Official guide available; most need a PAT for the remote server. |
| Codex, Gemini CLI, GitHub Copilot CLIYes | Official guide available. |
| ChatGPTUnclear | Not mentioned in the official guide; one user reported an account suspension after using it with ChatGPT (issue #3497), a single unverified report. |
What does GitHub MCP Server access, write and delete?
Repositories your identity can access: files, branches, commits, issues and PRs, Actions runs and logs, Dependabot, code scanning and secret scanning alerts, notifications, discussions, projects, organization and team members. Private repositories included; access is limited by your token's scope and your GitHub permissions.
Opening, updating, commenting on, reviewing and merging issues and PRs; creating and updating files, pushing; creating branches and repositories, forking; gists; labels; triggering Actions workflows; organization governance tools.
delete_file (deletes a file as a commit) and delete_repository (deletes a repository) are in the tool list; some tools include delete methods. You decide which tools are on through toolset and tool selection.
The remote server runs on GitHub infrastructure; with the local server the code runs on your machine and connects to the GitHub API. Content that is read (including private repository data) goes to the AI model you use.
| Read-only mode | How |
|---|---|
| Local server | --read-only flag or GITHUB_READ_ONLY=1 environment variable. |
| Remote server | /readonly URL or X-MCP-Readonly header. |
| Precedence | Read-only mode takes precedence: write tools are skipped even if explicitly requested with --tools (README). |
!Issue, PR, comment and commit text in public repositories can carry content that looks like instructions to the assistant. Lockdown mode filters content from users without push access, but the README states this is not an authorization boundary. Security advisories: GHSA-pjp5-fpmr-3349 (moderate, patched in 1.1.2) and GHSA-w4q6-qw23-4rg7 (high, unauthenticated crash). For the second, the GitHub advisory leaves the patched version blank and lists the affected range as "0.33.0 and below (including the latest main branch)"; OSV says it was fixed in 1.1.0. A definite patched version is unclear; use the latest version.
Organization side: access is always limited by the identity's GitHub permissions; there is no anonymous access. Admins use the "MCP servers in Copilot" policy, OAuth App access, PAT policies (classic tokens can be disabled) and SSO enforcement. There is no single "turn it all off" switch. Underlying API calls appear in the GitHub audit log; there is no MCP-specific logging yet.
Is GitHub MCP Server free, and do you need Copilot?
The server itself is free and MIT-licensed. GitHub Docs states it is available to all GitHub users regardless of plan type. In general a Copilot subscription is not required; however, tools tied to features that need a paid GitHub or Copilot license (for example the Copilot coding agent) need the same license, and Copilot access is a prerequisite for use in Visual Studio. For Copilot Business and Enterprise members, the organization's "MCP servers in Copilot" policy must be enabled. Running it on your own machine costs nothing from GitHub; Docker and model costs are yours. The official documentation gives no number for the API rate limit, only that it is subject to GitHub API limits.
- MIT: free to use, modify and use commercially
- The server is available to all GitHub users regardless of plan type
- Tools for features that need a paid Copilot or GitHub license need the same license
- The remote server is not supported for GitHub Enterprise Server; only local use
Source: GitHub Docs, the README and the policy document. This is not legal advice.
Common problems and fixes
| What happens | What to do |
|---|---|
| Tools don't appear in the list, or you get a 401 | The PAT must not be expired and must include the scope the tool needs (usually "repo"). With a classic PAT, tools without the scope are hidden from the list; with a fine-grained PAT all tools appear but the API denies permission. |
| Error while pulling the Docker image | Official guide: the image is public; an expired token may have caused the error. Run docker logout ghcr.io, then try again. |
| The remote server can't be added with "Add custom connector" in Claude Desktop | Official guide: not supported at the moment; use the local Docker setup. |
| Reported by users After v2.0.x, the Claude Code tool list fails to load with a "missing required resultType" error | Open issue #3453 (October 7, 2026): the reporting user wrote that the v1.14.0 image works; a commenter could not reproduce it on v2.0.1. Status unresolved. |
| Reported by users The Docker command with a PAT returns "unknown option -e" | Open issue #3032 (August 6, 2026); try the add-json form or the OAuth command instead. |
How do you remove GitHub MCP Server?
- Remove it from the client: In Claude Code,
claude mcp remove github; in Cursor, delete thegithubentry from ~/.cursor/mcp.json; in VS Code, delete it from the MCP configuration. - If you used a PAT: Revoke the token under GitHub › Settings then Developer settings › Personal access tokens. A fine-grained token makes revocation easier.
- If you connected with OAuth: Remove access from the authorized applications in your GitHub account.
- Docker (optional):
docker rmi ghcr.io/github/github-mcp-serverdeletes the local image.
Frequently asked questions
What is GitHub MCP Server?
GitHub's official, MIT-licensed MCP server. It lets an AI assistant read repositories and code, manage issues and pull requests, and review Actions runs and security alerts. It runs remotely (hosted by GitHub) or locally (Docker).
Is GitHub MCP Server free, and do you need a Copilot subscription?
The server is available to all GitHub users regardless of plan and is MIT-licensed. A Copilot subscription is generally not required, but tools tied to features that need a paid Copilot or GitHub license need the same license, and Copilot access is a prerequisite in Visual Studio.
Can the assistant accidentally delete my repository?
delete_repository and delete_file are in the tool list; you decide which tools are on through toolset and tool selection. Read-only mode (--read-only, /readonly, X-MCP-Readonly) turns off write tools entirely. Limiting the token to only the repositories you need (fine-grained PAT) is another safeguard.
Does lockdown mode protect against prompt injection?
Partly. Lockdown mode filters content from users without push access, but the README states it is not an authorization boundary and that filtered content may still be reachable through other tools.
Should I set it up remote or local?
The official guide presents the remote server as the easiest way. The local server is for clients without remote MCP support, GitHub Enterprise Server and customization, and it needs Docker.
Can it be added to Claude Desktop?
The remote server can't be added as a custom connector: the official guide states this requires an OAuth registration and is not supported at the moment. The local Docker setup is used instead.
Does it work with GitHub Enterprise?
For GitHub Enterprise Cloud, the remote server can be used. Remote hosting is not supported on GitHub Enterprise Server; the local server is used with the GitHub host setting. Organization policies (OAuth App, PAT, SSO) apply.
Tasks and setup kits that use GitHub MCP Server
Related guides
Sources
- github-mcp-server README
- Installation guide for Claude
- GitHub Docs: Setting up the GitHub MCP server
- github-mcp-server releases
Not clear in the official sources: Rate-limit figure (not given in the official documentation) · which plans include GitHub Advanced Security alerts · the full method list of mixed tools · OAuth consent screen and authorized applications menu path · a definite patched version for GHSA-w4q6-qw23-4rg7 (GitHub and OSV differ) · commands for the Rovo Dev CLI, Cline, Roo Code and Antigravity guides · Turkish support. Each is noted in the relevant section.