MCP · Code and collaboration · GitHub

GitHub MCP Server

Bring repository files, issues and pull requests into an AI conversation, with selectable tools and a documented read-only mode.

Source reviewHosted connection checksReviewed Oct 18, 2026Editorial position 1 in mcp servers

Official documentation ↗GitHub repository ↗See an example ↓Add to comparison →

Check before use

Untrusted repository content. Issue text and files can contain instructions aimed at the agent. Treat them as evidence, not authority.

Understand the tool

What it does.

GitHub's server exposes repository operations to an MCP-compatible AI application. MCP supplies the connection format; your application selects operations. Hosted and local deployments differ in setup and available tools.

Why use it?

Use it when the answer depends on current repository evidence. A release-readiness brief can connect unfinished issues, pull requests and failed checks without copying every page into chat.

A useful fit for

Repository orientation
Issue triage
Pull-request context

From need to output

Ways to put it to work.

These are suggested workflows based on the documented capabilities. They are not recorded runtime results.

Use case 01

Prepare a release brief

A maintainer needs a concise view of work still open for a release.

Name one repository and milestone.
Read matching issues, pull requests and available check results.
Group blockers and link the evidence.

Intended outputA reviewable brief; no release or merge is performed.

Use case 02

Turn a bug report into a proposed issue

A support report needs technical context before it enters the backlog.

Search for existing reports and relevant code.
Draft reproduction steps and the missing evidence.
Review the text before creating an issue.

Intended outputA better-scoped issue with fewer unsupported assumptions.

A concrete starting point

Illustrative prompt: release review

Select one repository and only the necessary read tools.

text · illustrative example

Review open work for the next release in the repository I selected. Link each blocker to an issue, pull request or failed check. Separate observed failures from your hypotheses. Do not edit, comment, merge or publish.

What this can change

The intended task reads repository data into the AI host; broader enabled tools can modify GitHub.

This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.

Before you start

Setup and access.

What you’ll need

An MCP host supporting the chosen remote or local transport.
GitHub authorization with access to the selected repositories; organization policies may restrict access.
Local deployment additionally needs its documented binary or container environment.

Authentication: Hosted OAuth or a supported token configuration; local server commonly uses a personal access token.
Can read: Authorized code, issues, pull requests and enabled workflow data
Can write or change: Enabled issue, pull-request and repository mutations
Network and data flow: GitHub API and authentication services
AI host/model provider according to host settings
Approval and control: Use server read-only mode for research. Host approval prompts are a separate control for enabled writes.

Check your environment

Compatibility, costs and license.

Compatibility notes

Remote MCP-capable hosts
Local stdio-capable hosts
Remote-only toolsets are not interchangeable with the local build

Costs and account requirements

Server code has no license fee. GitHub features, API limits and the AI host's subscription or usage charges still apply.

Current pricing or plan information ↗

MIT

Code license; hosted GitHub service terms remain separate.

Read the license or service terms ↗

Keep the boundaries visible

Concerns and limitations.

Untrusted repository content

Issue text and files can contain instructions aimed at the agent. Treat them as evidence, not authority.

Broad token access

A broadly scoped token can expose unrelated repositories. Read-only prevents mutations, not disclosure.

Where it may fall short

No live repository workflow was executed for this review.
Lockdown filtering is documented as best effort, not a security boundary.

Observed behavior · 2026-10-18

Runtime and security findings.

Hosted connection checks

Hosted initialization stopped at authentication. The read-only route also required a token; its discovery metadata still advertised broad OAuth scopes.

These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.

What we found

Observed in this evaluation

A read-only URL does not describe token scope

Both default and /readonly initialization returned 401. Both metadata documents advertised the same 10 scopes, including repo and write:packages. This is public discovery metadata, not a granted token or proof that write tools are available on /readonly.

In practice: Configure the read-only tool surface and restrict the credential separately. After signing in, verify the actual tools and selected repositories.

Documented concern

Content filtering has a separate job

GitHub describes lockdown filtering as best effort. It is not a security boundary, and remote toolsets differ from the local build.

In practice: Keep repository text as evidence. Review proposed actions and avoid broad credentials even when the task only reads.

Version, environment and fixture

Version or deployment: Remote deployment version not disclosed by the observed responses
Tested target: [GitHub remote MCP origin]/mcp/; origin omitted from this public record
Artifact identity: HTTPS certificate verification enabled. Public resource-metadata body SHA-256: cbabd24fd62d5d52687cd6e47d66a17a1d817a029834b757ee65e9d3cf1c7aef. This fingerprints the observed metadata, not the deployed server implementation.
Environment and fixture: Windows 11 build 26200; Python 3.12.10 urllib; OpenSSL 3.0.16.
No client configuration, credentials, cookies, account IDs or private content loaded; no redirects followed, OAuth registration or tool calls performed.
Observed 2026-10-19T00:47:10.611130+00:00 through 2026-10-19T00:47:52.509957+00:00 UTC.
One request per listed check; 20-second timeout and 64-KiB response cap. Initial sandbox DNS failures were retained separately and resolved with approved network access; they are not endpoint failures.

Checks and results

4 recorded checks. Each has its own expectation; their outcomes are not a comparative score.

Credential-free initializationMet expectation

Method: POST [GitHub remote MCP origin]/mcp/; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"IonBin-account-free-evaluation","version":"1.0.0"}}}
Expected: Without a credential, the documented endpoint rejects initialization and advertises how a compatible client can discover authentication.
Observed: HTTP 401 at 2026-10-19T00:47:10.611130+00:00. WWW-Authenticate: Bearer; resource_metadata=[GitHub remote MCP origin]/.well-known/oauth-protected-resource/mcp/. Response text reports the required Authorization header is missing.

Public authentication discoveryMet expectation

Method: GET [GitHub remote MCP origin]/.well-known/oauth-protected-resource/mcp/; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.
Expected: Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.
Observed: HTTP 200 at 2026-10-19T00:47:20.626366+00:00; Content-Type: application/json. Resource: [GitHub remote MCP origin]/mcp/. 10 supported scopes: repo, read:org, read:user, user:email, read:packages, write:packages, read:project, project, gist, notifications. Authorization server: https://github.com/login/oauth. Bearer methods: header.

Read-only variant: Credential-free initializationMet expectation

Method: POST [GitHub remote MCP origin]/mcp/readonly; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"IonBin-account-free-evaluation","version":"1.0.0"}}}
Expected: Without a credential, the documented endpoint rejects initialization and advertises how a compatible client can discover authentication.
Observed: HTTP 401 at 2026-10-19T00:47:24.665306+00:00. WWW-Authenticate: Bearer; resource_metadata=[GitHub remote MCP origin]/.well-known/oauth-protected-resource/mcp/readonly. Response text reports the required Authorization header is missing.

Read-only variant: Public authentication discoveryMet expectation

Method: GET [GitHub remote MCP origin]/.well-known/oauth-protected-resource/mcp/readonly; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.
Expected: Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.
Observed: HTTP 200 at 2026-10-19T00:47:52.509957+00:00; Content-Type: application/json. Resource: [GitHub remote MCP origin]/mcp/readonly. 10 supported scopes: repo, read:org, read:user, user:email, read:packages, write:packages, read:project, project, gist, notifications. Authorization server: https://github.com/login/oauth. Bearer methods: header.

Practical caveats

[GitHub remote MCP origin] is an explicit placeholder for the tested official host. Recover the exact current endpoint from the linked official GitHub remote-server guide; exact requests are retained in the private evaluation evidence.
Use a narrowly selected toolset plus read-only mode for research. A token that can read private repositories can still disclose their contents to the AI host.
Hosted service deployment identity was not disclosed by the observed responses; a local repository release does not identify this remote build.

What this evaluation does not establish

OAuth consent, token restrictions, repository or organization permissions, revocation and tenant isolation.
Actual tool lists, repository reads, write denial on /readonly, lockdown filtering and prompt-injection resistance.
The local binary/container and authenticated release-review example.
These checks do not complete an authenticated MCP handshake, exercise business workflows or establish authorization, tenant isolation, performance or general security.

Read the evaluation record (JSON) →

Sources for the evaluation and controls

The basis for this review

Why it’s in the collection.

A clear first example of useful MCP work, with documented tool selection and read-only controls. This is editorial ordering, not an adoption or safety score.

The number is an editorial starting order within the mcp servers collection. It does not measure popularity, speed, reliability or safety.

What we reviewed

capabilities
Remote/local setup
Tool and access controls

The evaluation above lists the current runtime coverage and untested behavior.

Source review

Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.

Read the ranking and review method →

Follow the evidence

Official sources.

Official server and capabilities ↗github.com
Configuration and read-only controls ↗github.com
Remote server differences ↗github.com
GitHub plans ↗github.com