MCP Index
Developer ToolsFreeactiveReviewed by MCPIndex

GitHub MCP Server

Official GitHub MCP server for repositories, issues, pull requests, Actions, code search, and security context.

View on GitHubView on NPMBrowse all tools

Looking for more MCP servers? Browse the full MCP tools directory or explore more tools in Developer Tools.

OverviewConfigSetupFAQRelated
Reviewed by MCPIndex

MCPIndex assessment

GitHub MCP is the anchor integration for developer agents because it exposes the causal graph around code, not just the files. Its security posture is entirely token- and branch-policy-dependent. Fine-grained repository scope, identifier grounding, and approval before mutation turn it into a serious engineering system; a broad PAT turns it into a prompt-injection target with write access to your software supply chain.

Quick overview

GitHub MCP is not a code-search plugin; it is a repository control plane attached to an agent. The critical architectural shift is that code, issue history, pull requests, Actions runs, and security findings become one traversable graph instead of five browser tabs with manually copied context. An agent can inspect the exact commit that introduced a regression, read the linked issue, examine the failed workflow, and draft a minimal pull request without losing the causal chain between them. The hidden risk is authorization inheritance: the server can act with the permissions of its token, and a prompt-injected issue or README can attempt to steer the agent toward secrets, destructive operations, or unauthorized repository changes. Use fine-grained tokens, repository allowlists, read-only mode for analysis, and branch protection for every write path. The production-grade pattern is evidence first, mutation second: retrieve the repository, branch, file, and issue identifiers; show the proposed diff; then require a human approval before opening a pull request or changing workflow state.

Best for

The teams and workflows that benefit most from this tool.

Repository-aware code review

Issue and pull-request triage

GitHub Actions diagnosis

Security-context analysis around code changes

What this MCP server is best for

  • Managing repositories, pull requests, issues, and branches directly through GitHub MCP Server.
  • Reviewing code changes, checking CI status, and commenting on PRs without leaving your AI client.
  • Supporting GitHub-heavy development teams that want AI-assisted repository operations end to end.

When to choose it

Choose GitHub MCP Server when your repositories, pull requests, and issues already live in GitHub and you want direct AI-assisted repository operations.

Good fit

githubrepositoriespull-requestsissuesactionscode-review

Limitations

Things to watch before choosing this tool.

Token scope determines the blast radius

Names and branches must be grounded before writes

External repository content can contain prompt injection

Workflow and administrative actions require strict approval

GitHub MCP Server Configuration

Use the following configuration as a starting point for Claude Desktop or any compatible MCP client, then replace placeholder credentials with your own values.

claude_desktop_config.json
{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_your_fine_grained_token"
      }
    }
  }
}

How to set up GitHub MCP Server

These setup steps cover the typical installation flow for this MCP server.

  1. 1

    Create a fine-grained GitHub token restricted to the exact repositories and permissions required; begin with metadata, contents read, issues read, and pull requests read.

  2. 2

    Configure the server with GITHUB_PERSONAL_ACCESS_TOKEN and verify the token owner, organization, repositories, and effective permissions before using any write tool.

  3. 3

    Pro-Tip: The fatal flaw 90% of developers commit is giving the agent a classic broad PAT and assuming repository context is a safety boundary. It is not: a README, issue, or external contribution can contain prompt injection that tells the agent to search other repositories or exfiltrate secrets. Use a fine-grained token with an explicit repository allowlist, keep Actions and administration permissions disabled, and rely on branch protection for every mutation.

  4. 4

    Require repository and branch grounding before writes: resolve the owner, repository, default branch, and target issue or pull request from live GitHub data instead of trusting names supplied in a prompt.

  5. 5

    Never expose Actions secrets or workflow write permissions to an analysis-only agent; use a separate approval workflow for dispatching or modifying workflows.

  6. 6

    Verify with: identify the authenticated account, list the allowed repositories, inspect one issue, and read one file. A correct setup proves scope before code operations.

Compatibility

Supported environments for GitHub MCP Server.

Claude Desktop

Yes

Cursor

Yes

VS Code

Yes

Official server with fine-grained token support. Start read-only, allowlist repositories, and protect every write path with branch policies.

Frequently asked questions

Common questions for GitHub MCP Server.

The agent edits the wrong repository or branch — the API succeeds and no error appears. Why?

This is the silent failure of identifier grounding. Repository names, forks, branch names, and issue numbers are human-friendly but ambiguous across organizations and sessions. The request is valid, so GitHub accepts it against the wrong target. The engineering fix is to resolve and echo the owner, repository ID, branch ref, and commit SHA before every write; require a diff against the expected base SHA and block the action if any identifier differs.

Can GitHub MCP create pull requests and modify issues?

Yes when the token and server expose write permissions. Keep analysis tokens read-only and route branch creation, issue mutation, and pull-request creation through a human approval gate with the exact target and diff shown.

How does it help with code review?

It can combine the diff, surrounding files, issue context, prior review comments, checks, and security findings in one workflow. The agent should still distinguish deterministic check results from its own judgment.

Can it access private repositories?

Yes, subject to the token's repository selection and organization policies. Fine-grained access and SSO authorization should be verified before debugging the MCP layer.

GitHub MCP Server vs Competitors

FeatureGitHub MCP ServerCompetitor
Repository context✅ Code, issues, PRs, Actions, and security data in one graph❌ IDE-only context without issue and workflow history
Change workflow✅ Can inspect, propose, and create repository changes❌ Read-only code indexing
Authorization✅ Fine-grained GitHub token and repository policies❌ Local filesystem access may bypass repository governance
Deterministic review evidence✅ Checks, diffs, and comments are available as source records❌ LLM-only review relies on model interpretation

Related Guides

GitHub MCP Server Setup

Install and configure GitHub MCP Server step by step.

GitHub MCP Authentication

Fix token scopes, PAT issues, and private repo access problems.

Best MCP Tools for GitHub Workflows

Compare the best MCP stack for pull requests, docs, and security.