GitHub MCP Server Authentication (2026)
Master GitHub MCP authentication in Claude Desktop. Learn PAT setup, scopes, private repo access, and fix common errors. Grab our free cheatsheet for quick reference.
Need installation help? Start with GitHub MCP Server Setup or Claude Desktop MCP Setup.
Quick answer
In most Claude Desktop setups, GitHub MCP works best with a Personal Access Token passed through the MCP server environment. If private repositories are not visible, the usual cause is missing repository scope or incomplete fine-grained permissions.
- Use a PAT for the simplest local setup.
- Start with the minimum scopes needed for your workflow.
- Re-check private repository permissions before assuming the server is broken.
How GitHub MCP authentication works
In most local Claude Desktop setups, GitHub MCP Server authenticates with a GitHub Personal Access Token passed through the GITHUB_PERSONAL_ACCESS_TOKEN environment variable. The server then uses that token to decide which GitHub APIs it can access and, in some setups, which MCP tools it should expose.
In remote setups, OAuth can also be used. In practice, PAT-based configuration remains the most common path for local development and Claude Desktop workflows.
Recommended token scopes
For many developer workflows, a practical classic token baseline is:
| Scope | Why it matters |
|---|---|
repo | Grants access to private repositories and many repository-level operations. |
read:org | Helps the server read organization membership and organization-level visibility. |
read:user | Provides basic user account information needed for account-aware workflows. |
Broad classic scopes are easier to configure, but they also grant wider access. If you need tighter control, use a fine-grained token and verify repository permissions one by one.
Classic vs fine-grained tokens
Classic PAT
Classic personal access tokens use broad scopes like repo and read:org. They are usually easier to configure and remain the simplest choice for many GitHub MCP tutorials.
They are a good fit when you want a fast local setup and are comfortable with broader repository access.
Fine-grained PAT
Fine-grained tokens let you restrict access to selected repositories and narrower permission sets. They are safer in principle, especially in sensitive or multi-repository environments.
The tradeoff is setup complexity. If you miss a required permission, GitHub MCP may authenticate successfully but still fail on specific actions.
Private repository access
A common support issue is that GitHub MCP Server appears to work, but Claude cannot see a private repository. In many cases, the token simply lacks sufficient repository permissions. A token with only public access can still authenticate successfully while failing on private repository operations.
If you use a fine-grained token, confirm that the specific repositories are included and that the repository-level permissions cover the actions you want Claude to perform.
How to check your token scopes
One practical way to inspect your token is to make an authenticated request to the GitHub API and review the response headers.
curl -sI -H "Authorization: Bearer $GITHUB_PERSONAL_ACCESS_TOKEN" \ https://api.github.com/user | grep -i x-oauth-scopes
This helps confirm whether the token actually contains the scopes you expect.
Why some tools may be missing
A missing tool is not always a server bug. In practice, narrower token permissions can limit what the MCP server is willing or able to expose for a workflow.
If one action works and another fails, compare the permissions required for each action before assuming the installation is broken.
Common authentication errors
Token is valid, but private repos are invisible
Your token likely lacks repo access, or a fine-grained token is not scoped to the correct repositories.
Some tools are missing in Claude
A GitHub MCP setup may expose fewer tools when the token permissions are narrower than the workflow requires.
Issue or PR actions fail
The token may authenticate correctly but still lack the permissions needed for pull requests, issues, or repository writes.
The token works in GitHub CLI but not in MCP
Check whether the token is being passed into the MCP server environment variable correctly. A typo in the env block is a common cause.
Auth seems correct, but Claude still fails
Fully restart Claude Desktop after changing the config. MCP servers often keep the old environment until the client restarts.
Best practices for safer auth
Use least privilege
Start with the minimum repository and organization access needed for your workflow instead of granting everything by default.
Separate work and personal tokens
Use distinct tokens for company repositories and personal projects so you can rotate or revoke them independently.
Prefer fine-grained tokens for sensitive setups
If your environment is security-sensitive, fine-grained tokens are worth the extra configuration effort.
Get the GitHub MCP Auth Cheat Sheet
Stop struggling with token scopes. Download our concise Markdown cheat sheet with the exact scopes, classic vs fine‑grained comparison, common errors and fixes, and the token check command – all in one place.
- ▹ Recommended scopes table
- ▹ Classic vs fine-grained decision guide
- ▹ Top 5 auth errors and fixes
Instant .md download. No email required.
Related guides
Frequently asked questions (2026)
How does GitHub MCP Server authentication work in 2026?▾
GitHub MCP Server authenticates primarily via a Personal Access Token (classic or fine-grained) passed as an environment variable. OAuth is also possible in remote setups. Most Claude Desktop installs use the PAT method.
Which token scopes do I need for GitHub MCP Server?▾
A safe baseline for 2026 is repo, read:org, and read:user. These cover private repositories, organization visibility, and basic user info. Adjust according to your workflow.
Can GitHub MCP Server access private repositories?▾
Yes, if your token has the repo scope (classic) or the specific repository selected with correct permissions (fine-grained). Without this, only public repos are visible.
What is the difference between classic and fine-grained tokens?▾
Classic tokens use broad scopes; fine-grained tokens allow per‑repo, per‑permission control. Fine-grained is safer but more complex to set up correctly.
Why are some GitHub MCP tools missing in Claude?▾
The server hides tools it cannot use based on the token's permissions. Missing scopes cause tools to disappear or fail silently.
How do I check what scopes my GitHub token has?▾
Run a curl command to the GitHub API and inspect the x-oauth-scopes header. The cheatsheet we provide includes the exact command.
Continue exploring GitHub MCP
Full setup guide, tool page, and category directory.