Build my server

Guides

GitHub MCP Server: Setup, Tokens and Security (Oct 2026)

By Team TrustedMCP

On this page
GitHub MCP Server: Setup, Tokens and Security (Oct 2026)

The GitHub MCP server is GitHub's own official server. You can use the hosted version at https://api.githubcopilot.com/mcp/ or run it locally with Docker or a release binary. It lets an agent work with repos, issues, pull requests and Actions. TrustedMCP grades it A.

It is open source at github/github-mcp-server. It is very active and is the most common way to give an agent GitHub access.

What it connects

  • Read: repos, files, issues, pull requests, Actions runs, code security alerts, notifications and more, grouped into "toolsets".
  • Write: create issues and PRs, comment, push files, merge PRs and trigger workflows, limited by what your token allows.
  • Default toolsets: context, repos, issues, pull_requests and users. You add others, such as actions, only if you need them.

Setup

All snippets below come from GitHub's README and installation guides. Replace <github_pat> with your own token. Never commit it.

Claude Code (version 2.1.1 or newer), hosted server with a token:

claude mcp add-json github '{"type":"http","url":"https://api.githubcopilot.com/mcp","headers":{"Authorization":"Bearer <github_pat>"}}'

On older Claude Code versions, or if add-json returns Invalid input on Windows, GitHub's guide gives the older form:

claude mcp add --transport http github https://api.githubcopilot.com/mcp -H "Authorization: Bearer <github_pat>"

Cursor (~/.cursor/mcp.json). GitHub's guide says Cursor needs a token here, not OAuth:

{ "mcpServers": { "github": { "url": "https://api.githubcopilot.com/mcp/",
  "headers": { "Authorization": "Bearer <github_pat>" } } } }

VS Code 1.101 or newer (.vscode/mcp.json). This uses OAuth sign-in, so no token sits in the file:

{ "servers": { "github": { "type": "http", "url": "https://api.githubcopilot.com/mcp/" } } }

Claude Desktop cannot use the hosted server as a custom connector yet, per GitHub's guide. Run it locally with Docker instead. The server opens a browser login on first use and keeps the token in memory only:

{ "mcpServers": { "github": { "command": "docker",
  "args": ["run", "-i", "--rm", "-p", "127.0.0.1:8085:8085", "-e", "GITHUB_OAUTH_CALLBACK_PORT", "ghcr.io/github/github-mcp-server"],
  "env": { "GITHUB_OAUTH_CALLBACK_PORT": "8085" } } } }

Security notes

This server can change real code, so most of the work is limiting what it can do.

The token is the main risk. In Claude Code and Cursor, the hosted server needs a personal access token (PAT) in your config. Use a fine-grained PAT limited to one owner, only the repos the agent needs, and the fewest permissions. A classic PAT reaches every repo you can access. GitHub suggests keeping the token in a .env file or environment variable and adding that file to .gitignore.

OAuth asks for a lot by default. The local server's OAuth login requests the full supported set of scopes unless you narrow it with --oauth-scopes (or GITHUB_OAUTH_SCOPES). Narrowing it also hides tools that need scopes you didn't grant.

Use read-only when you can. Each option below removes all write tools:

  • Hosted: use https://api.githubcopilot.com/mcp/readonly, or send the X-MCP-Readonly: true header.
  • Local: pass --read-only, or set GITHUB_READ_ONLY=1 in Docker.

Load only the toolsets you need. Locally, use --toolsets repos,issues (or GITHUB_TOOLSETS). On the hosted server, each toolset has its own URL, such as https://api.githubcopilot.com/mcp/x/issues, and adding /readonly makes it read-only. To combine several, use the X-MCP-Toolsets header.

Turn on lockdown mode for public repos. Issue, PR and comment text can be written by anyone. That text can carry instructions aimed at the model. Lockdown mode (--lockdown-mode, GITHUB_LOCKDOWN_MODE=1, or the X-MCP-Lockdown header) hides public content from authors without push access. GitHub calls it a best-effort filter, not a security boundary.

Keep approval on for write tools. Pushing files, merging PRs and running workflows should always need a human click. More in MCP security best practices and is it safe to install an MCP server.

Why it grades A

Here is how it does on each check:

  • Maintenance, 25 of 25. Frequent commits and releases from many maintainers.
  • Known CVEs, 25 of 25. Two past advisories, CVE-2026-48529 and CVE-2026-47427, were both fixed before they were disclosed. Nothing is open.
  • Transport, 20 of 20. The hosted server runs over HTTPS. The local server binds its OAuth callback to loopback.
  • Authentication, 18 of 30. This is the only deduction. In Claude Code and Cursor, hosted use means pasting a PAT into config. The local OAuth login requests every scope unless you narrow it.

Full breakdown on the GitHub MCP listing. The method is in how TrustedMCP scores servers.

FAQs

How do I set up the GitHub MCP server? Pick your client above and paste the snippet. In VS Code you sign in with OAuth. In Claude Code and Cursor you create a PAT and put it in the header. Restart the client, then check the server shows up (claude mcp list in Claude Code).

Which token or PAT scopes do I need? Use a fine-grained PAT with only the repos the agent should touch. Grant read access for reading and add write permissions only for the actions you want. If you use a classic PAT, GitHub's README lists repo, read:packages and read:org as the common minimum. With a classic PAT, the server hides tools your token's scopes can't use.

Why do I get a 403 or "Resource not accessible" error? The token can't reach that resource. Common causes, from GitHub's docs:

  • A classic PAT is missing the needed scope.
  • The org uses SAML single sign-on and you haven't authorized the classic PAT for that org.
  • A fine-grained PAT has the wrong resource owner, doesn't include that repo, or lacks the permission.
  • The org requires approval for fine-grained PATs, and yours is still pending. Until approved it can only read public resources.

With a fine-grained PAT the server shows every tool, so you only find out when a call fails.

Does it use a lot of context tokens? It can. Every tool description loads into context before you start. Fewer toolsets means fewer tools, and GitHub notes this reduces context size. Read-only mode drops the write tools too. See why MCP servers eat your context window.

Can I make it read-only? Yes. Use the /mcp/readonly URL or the X-MCP-Readonly header on the hosted server, or --read-only / GITHUB_READ_ONLY=1 locally. Read-only mode wins even if you ask for a write tool by name.

Hosted or local? Hosted is easier and gets updates without any action from you. Local with Docker lets Claude Desktop use OAuth and keeps the token in memory. Either way, the token's permissions decide what the agent can do.