This profile is part of our MCP server directory, within The MCP Guide. Profiles are checked against each vendor's own documentation. Need a server built? See MCP development.
The GitHub MCP Server lets an AI app read repositories, manage issues and pull requests, check Actions runs and review security alerts. GitHub publishes it as open source, with a hosted remote version and a local version you run yourself.
Checked against: GitHub MCP Server README on 28 October 2026. eSEOspace did not install or test this server.
Key Takeaways
- The remote server runs at
https://api.githubcopilot.com/mcp/and signs in with OAuth or a personal access token (PAT). - GitHub says the server is "available to all GitHub users regardless of plan type," though some tools need a paid feature.
- Toolsets let you load only the groups of tools you need, and
--read-onlyoverrides everything else. - Lockdown mode filters content from people without push access, which helps against prompt injection in public repos.
- The full tool list includes destructive tools such as
delete_fileanddelete_repository, so scope your token carefully.
At a glance
| Item | Detail |
|---|---|
| Publisher | GitHub |
| Official? | Yes |
| Hosting | Both: remote URL and local Docker image or binary |
| Transport | HTTP (remote), stdio (local) |
| Sign-in | OAuth or personal access token |
| Read or write | Read and write; read-only mode available |
| Price | Free for all GitHub users; some tools need paid features |
| Source code | github/github-mcp-server (MIT) |
| Status | Not stated as beta or GA; an "insiders" mode offers experimental tools |
What it can do
The README groups tools into toolsets. If you set nothing, the default toolset loads context, repos, issues, pull_requests and users.
Other toolsets you can turn on include:
actionsfor GitHub Actions workflows and CI/CDcode_security,secret_protectionanddependabotfor security alertsdiscussions,gists,labels,notifications,orgsandprojectsgitfor low-level Git API callsgovernancefor rulesets and custom properties
Tool names published in the README include get_file_contents, search_code, list_issues, issue_write, create_pull_request, pull_request_read, merge_pull_request, actions_list, get_job_logs and list_dependabot_alerts. The remote server adds copilot_spaces, github_support_docs_search and create_pull_request_with_copilot, which hands a task to Copilot coding agent.
You can also pick single tools with --tools, or combine them with toolsets.
How to connect it
The README lists VS Code 1.101+, Claude Desktop, Cursor and Windsurf (now Devin Desktop) as hosts with remote server support. For VS Code, the OAuth config is:
{
"servers": {
"github": {
"type": "http",
"url": "https://api.githubcopilot.com/mcp/"
}
}
}VS Code's MCP server docs still support .vscode/mcp.json "for compatibility" but label it deprecated in the guided setup flow, as of October 2026. Servers that prompt for values with ${input:...} aren't forwarded to Copilot harness sessions.
For a local server in Claude Code with a PAT, the README gives this command:
claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=$GITHUB_PAT -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-serverThe local server can also log you in with OAuth in the browser on first use. The README says that token "is kept in memory only." GitHub Enterprise Server does not support the remote server, so those teams run it locally with their own OAuth or GitHub App.
In Copilot Business or Enterprise organizations, GitHub's docs say the "MCP servers in Copilot" policy must be on.
Security notes
GitHub gives you three main controls:
- Read-only mode. The
--read-onlyflag offers only read tools. The README says "read-only mode takes priority," so write tools are skipped even if you request them. - Toolsets. Loading fewer toolsets shrinks what the AI can touch and keeps the tool list short.
- Lockdown mode.
--lockdown-modewithholds or filters issues, pull requests and comments written by people without push access. GitHub calls it "a best-effort content filter," "not an authorization boundary."
For PATs, the README advises minimum scopes, separate tokens per project, regular rotation and never committing tokens. Remember that the AI can do anything your token allows, including deleting files or repositories.
The MCP project's security best practices also cover risks such as token passthrough, confused deputy attacks and scope minimization.
Public issues and pull requests are untrusted text. Read our guides to prompt injection through tool results and excessive permissions, and see the MCP Security Center for more.
Alternatives
- GitLab MCP server if your code lives on GitLab.
- Atlassian Rovo MCP Server, which covers Bitbucket Cloud along with Jira and Confluence.
- Sourcegraph MCP server for code search across many repositories and hosts.
Next step
Before you connect any code host, decide which toolsets and scopes the AI really needs. The MCP server directory lists other developer tools to pair with it. If you want help setting this up in Claude Code, see our Claude Code development service.
Frequently asked questions
Is the GitHub MCP Server free?
Yes. GitHub's docs say it is available to all GitHub users regardless of plan type. Tools tied to paid features, such as Copilot coding agent, need the matching paid license.
Can I make the GitHub MCP Server read-only?
Yes. Start the local server with --read-only, and only read tools are offered. The README says read-only mode overrides any tools you request by name.
What is the difference between the remote and local GitHub MCP Server?
The remote server is hosted by GitHub at https://api.githubcopilot.com/mcp/ and has a few extra toolsets, such as Copilot Spaces. The local server runs in Docker or from source, and it is the option for GitHub Enterprise Server.
Does lockdown mode stop prompt injection?
It reduces the risk but does not stop it. GitHub describes lockdown mode as a best-effort filter, not an authorization boundary, so content may still be reachable through other tools with the same credential.
