GitHub MCP Server is for teams that want an AI client to work with GitHub through a defined tool interface instead of guessing at repository state from a chat prompt. The repository identifies it as GitHub's official MCP Server, and its documented tools cover GitHub resources such as Actions information alongside broader repository workflows. That makes it useful when the question is operational: what changed in a pull request, which workflow failed, what issue context matters, or which repository action should be considered next.
The important value is controlled access to real project state. A coding agent can be useful when it can inspect a pull request, issue, workflow, or repository configuration, but that same capability becomes risky if every integration is granted broad write authority by default. The server's design gives a team a place to make the boundary explicit: which client can connect, which authorization method is used, and which tool groups are exposed. The evaluation is therefore about governance as much as convenience.
This is not a substitute for GitHub permissions, branch protection, or human review. It can help an agent retrieve context and propose the next action, but the organization still owns the policy for repository changes. It is strongest where developers repeatedly move between an AI assistant and GitHub context and want that movement to be observable, scoped, and based on the current state of the service.
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
Start with an investigative workflow. A developer can ask an agent to summarize a failing workflow run, locate the pull request connected to an issue, or assemble repository context before planning a change. That is a safer first use than asking an agent to modify labels, branches, comments, or pull requests. The server can then earn broader use only after the team has seen that its selected tools, returned context, and proposed actions are understandable to the people reviewing the work.
The documented remote and local modes support different operating models. A remote server can reduce client-side setup for an approved environment, while a local Docker-based deployment gives a team more control over where the process runs and how it is configured. The correct choice depends on identity, network, and data boundaries rather than on a generic preference for hosted or local tooling. Pilot one mode in one IDE and document the exact account and repository scope before trying to standardize it.
Toolsets are the key lever for a focused rollout. The README says that selecting only the capability groups a workflow needs can reduce context and make tool choice easier for the model. Apply that idea to real roles: a release analyst may need workflow and issue visibility, while a coding assistant evaluating a change might need pull-request context but not broad administrative actions. A narrow toolset makes both the agent's choices and the reviewer's job clearer.
Choose the authentication path before installing the server. The project documents an OAuth route in supported GitHub Copilot IDE flows and token-based Docker configuration for other setups. Those are not interchangeable implementation details. OAuth can reduce the need for a developer to create and store a personal token in a supported flow, whereas a token-based deployment requires the team to decide who issues the token, what scopes it has, where it is injected, and how it is rotated or revoked.
Use the least authority needed for the pilot. The README identifies OAuth scope requirements for individual tools, which is a reminder that a broad server connection can represent many different privileges. Begin with a dedicated test repository or a read-only environment. Confirm the server receives the intended identity, log which tool calls are made, and ensure that the client cannot silently expand its access through a convenience default. The production version of this decision belongs alongside the team's existing GitHub access review.
Client setup needs the same care. The repository documents installations across several MCP-aware environments, but the integration surface varies by host. Validate the exact configuration in the client developers use, including Docker availability and browser or callback behavior for sign-in. Keep secrets out of shared configuration files, and write a removal path before making the tool a recommended part of onboarding.
Do not add the server when a simple GitHub URL, CLI command, or existing CI integration already answers the question. Giving an AI client repository tools introduces an authorization surface that needs ongoing maintenance. For a one-off issue lookup or a workflow a developer already understands, the integration may create more configuration and review overhead than it removes. Its value rises when an agent repeatedly needs current GitHub context as part of work that a human still reviews.
It is also the wrong starting point for teams that cannot clearly define write authority. The server documents a read-only mode specifically for preventing modifications to repositories, issues, and pull requests. Use that mode for investigation, onboarding, and early evaluation. Moving from read-only visibility to change-capable toolsets should be a separate decision backed by permissions, audit expectations, and a review workflow, not an accidental consequence of connecting a full-featured client.
Consider lockdown requirements before exposing public-repository material to an agent. The documented mode applies an author-access test to some public content and has different behavior for private repositories and collaborators. That is useful only when the team understands what it protects and what it does not. Security-sensitive workflows should validate the mode with representative repositories and policies rather than assume a name like lockdown makes every returned artifact safe to trust.
Run a read-only pilot around a workflow with known answers. For example, ask the connected client to identify a failed Actions run, summarize the related pull request, and list the repository evidence a reviewer should inspect. Compare its answer with the normal GitHub interface and record whether the selected tools brought back the right data, omitted important context, or encouraged an unsafe shortcut. This establishes whether the agent improves triage before the team discusses write operations.
Test one deployment and authentication combination at a time. A team using a supported Copilot IDE can evaluate the documented OAuth flow; a team needing a local environment can test the Docker path with a tightly scoped credential. In either case, start with only the relevant toolsets and enforce the server's read-only capability while the workflow is being measured. That makes failed experiments cheap and keeps the security posture legible.
Adopt more of the server only when the pilot reduces context-switching without weakening permission discipline. Keep sensitive tools behind explicit approval, document each capability group, and revisit the configuration when clients or GitHub scopes change. The server can make AI-assisted repository work materially more useful, but the decision should be grounded in the team's access model and the quality of the review it preserves.
Supports Claude Code, Codex, Cursor, Windsurf, Mcp
Carries strong trust indicators from repository metadata
31323 GitHub stars recorded
Open Issues
335
Last Commit
Jul 9, 2026
Language
Go
License
MIT
Author
github
Maintainer Reach
—
Install Type
claude
Homepage
—
Install in GitHub Copilot on VS Code
For quick installation, use one of the one-click install buttons above. Once you complete that flow, toggle Agent mode (located by the Copilot Chat text input) and the server will start.
Install in GitHub Copilot on other IDEs (JetBrains, Visual Studio, Eclipse, etc.)
Add one of the following JSON blocks to your IDE's MCP settings.
Log in with OAuth (no token to create or store). On github.com the official image already includes the app credentials, so you provide none yourself: it runs a browser-based login on first use and keeps the resulting token in memory only. In Docker this needs a fixed callback port published to loopback so the container's login callback is reachable:
See Local Server OAuth Login for the native-binary flow (no fixed port needed), the headless/device-code fallback, GitHub Enterprise Server / ghe.com, and bringing your own OAuth or GitHub App.
Or authenticate with a Personal Access Token. Set GITHUB_PERSONAL_ACCESS_TOKEN instead (it takes precedence over OAuth):
Optionally, you can add a similar example (i.e. without the mcp key) to a file called .vscode/mcp.json in your workspace. This will allow you to share the configuration with other host applications that accept the same format.
Note: Any host application that supports local MCP servers should be able to access the local GitHub MCP server. However, the specific configuration process, syntax and stability of the integration will vary by host application. While many may follow a similar format to the examples above, this is not guaranteed. Please refer to your host application's documentation for the correct MCP configuration syntax and setup process.
Build from source
If you don't have Docker, you can use go build to build the binary in the
cmd/github-mcp-server directory, and use the github-mcp-server stdio command with the GITHUB_PERSONAL_ACCESS_TOKEN environment variable set to your token. To specify the output location of the build, use the -o flag. You should configure your server to use the built executable as its command. For example:
The github-mcp-server binary includes a few CLI subcommands that are helpful for debugging and exploring the server.
github-mcp-server tool-search "<query>" searches tools by name, description, and input parameter names. Use --max-results to return more matches.
Example (color output requires a TTY; use docker run -t (or -it) when running in Docker):
To run the server in a container, you will need to have Docker installed.
Once Docker is installed, you will also need to ensure Docker is running. The Docker image is available at ghcr.io/github/github-mcp-server. The image is public; if you get errors on pull, you may have an expired token and need to docker logout ghcr.io.
Authentication. On github.com you don't need to create anything up front — the one-click buttons above log you in with OAuth on first use (a browser-based flow; the token is kept in memory only). The Docker buttons publish a fixed callback port () so the container's login callback is reachable. See for how it works, headless/device-code fallback, and bringing your own OAuth or GitHub App (required for GitHub Enterprise Server and ).
Prefer a token? You can still authenticate with a GitHub Personal Access Token by setting GITHUB_PERSONAL_ACCESS_TOKEN instead (it takes precedence over OAuth). The MCP server can use many of the GitHub APIs, so enable the permissions that you feel comfortable granting your AI tools (to learn more about access tokens, please check out the documentation).
Environment Variables (Recommended)
To keep your GitHub PAT secure and reusable across different MCP hosts:
Store your PAT in environment variables
export GITHUB_PAT=your_token_here
Or create a .env file:
GITHUB_PAT=your_token_here
Protect your .env file
# Add to .gitignore to prevent accidental commits
echo ".env" >> .gitignore
Reference the token in configurations
# CLI usage
claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=$GITHUB_PAT -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server
# In config files (where supported)
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "$GITHUB_PAT"
}
Note: Environment variable support varies by host app and IDE. Some applications (like Windsurf) require hardcoded tokens in config files.
Token Security Best Practices
Minimum scopes: Only grant necessary permissions
repo - Repository operations
read:packages - Docker image access
read:org - Organization team access
Separate tokens: Use different PATs for different projects/environments
Regular rotation: Update tokens periodically
Never commit: Keep tokens out of version control
File permissions: Restrict access to config files containing tokens
chmod 600 ~/.your-app/config.json
GitHub Enterprise Server and Enterprise Cloud with data residency (ghe.com)
The flag --gh-host and the environment variable GITHUB_HOST can be used to set
the hostname for GitHub Enterprise Server or GitHub Enterprise Cloud with data residency.
For GitHub Enterprise Server, prefix the hostname with the https:// URI scheme, as it otherwise defaults to http://, which GitHub Enterprise Server does not support.
For GitHub Enterprise Cloud with data residency, use https://YOURSUBDOMAIN.ghe.com as the hostname.
user: Username to get teams for. If not provided, uses the authenticated user. (string, optional)
assign_copilot_to_issue - Assign Copilot to issue
Required OAuth Scopes: repo
base_ref: Git reference (e.g., branch) that the agent will start its work from. If not specified, defaults to the repository's default branch (string, optional)
custom_instructions: Optional custom instructions to guide the agent beyond the issue body. Use this to provide additional context, constraints, or guidance that is not captured in the issue description (string, optional)
issue_number: Issue number (number, required)
owner: Repository owner (string, required)
repo: Repository name (string, required)
request_copilot_review - Request Copilot review
Required OAuth Scopes: repo
owner: Repository owner (string, required)
pullNumber: Pull request number (number, required)
repo: Repository name (string, required)
get_dependabot_alert - Get dependabot alert
Required OAuth Scopes: security_events
Accepted OAuth Scopes: repo, security_events
alertNumber: The number of the alert. (number, required)
owner: The owner of the repository. (string, required)
repo: The name of the repository. (string, required)
list_dependabot_alerts - List dependabot alerts
Required OAuth Scopes: security_events
Accepted OAuth Scopes: repo, security_events
after: Cursor for pagination. Use the cursor from the previous response. (string, optional)
owner: The owner of the repository. (string, required)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
repo: The name of the repository. (string, required)
severity: Filter dependabot alerts by severity (string, optional)
state: Filter dependabot alerts by state. Defaults to open (string, optional)
body: Comment content (required for 'add', 'reply', and 'update' methods) (string, optional)
commentNodeID: The Node ID of the discussion comment (required for 'reply', 'update', 'delete', 'mark_answer', and 'unmark_answer' methods). For 'reply', this is the top-level comment to reply to; GitHub Discussions only support one level of nesting. (string, optional)
discussionNumber: Discussion number (required for 'add' and 'reply' methods) (number, optional)
method: Write operation to perform on a discussion comment.
Options are:
'add' - adds a new top-level comment to a discussion.
'reply' - replies to a top-level discussion comment (GitHub Discussions only support one level of nesting).
'update' - updates an existing discussion comment.
'delete' - deletes a discussion comment.
'mark_answer' - marks a discussion comment as the answer (Q&A only).
'unmark_answer' - unmarks a discussion comment as the answer (Q&A only).
(string, required)
owner: Repository owner (required for 'add' and 'reply' methods) (string, optional)
repo: Repository name (required for 'add' and 'reply' methods) (string, optional)
get_discussion - Get discussion
Required OAuth Scopes: repo
discussionNumber: Discussion Number (number, required)
owner: Repository owner (string, required)
repo: Repository name (string, required)
get_discussion_comments - Get discussion comments
Required OAuth Scopes: repo
after: Cursor for pagination. Use the cursor from the previous response. (string, optional)
discussionNumber: Discussion Number (number, required)
includeReplies: When true, each top-level comment will include its replies nested within it (up to 100 replies per comment, which is the GitHub API maximum). Defaults to false. (boolean, optional)
owner: Repository owner (string, required)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
repo: Repository name (string, required)
list_discussion_categories - List discussion categories
Required OAuth Scopes: repo
owner: Repository owner (string, required)
repo: Repository name. If not provided, discussion categories will be queried at the organisation level. (string, optional)
list_discussions - List discussions
Required OAuth Scopes: repo
after: Cursor for pagination. Use the cursor from the previous response. (string, optional)
category: Optional filter by discussion category ID. If provided, only discussions with this category are listed. (string, optional)
direction: Order direction. (string, optional)
orderBy: Order discussions by field. If provided, the 'direction' also needs to be provided. (string, optional)
owner: Repository owner (string, required)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
repo: Repository name. If not provided, discussions will be queried at the organisation level. (string, optional)
create_gist - Create Gist
Required OAuth Scopes: gist
content: Content for simple single-file gist creation (string, required)
description: Description of the gist (string, optional)
filename: Filename for simple single-file gist creation (string, required)
public: Whether the gist is public (boolean, optional)
get_gist - Get Gist Content
gist_id: The ID of the gist (string, required)
list_gists - List Gists
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
since: Only gists updated after this time (ISO 8601 timestamp) (string, optional)
username: GitHub username (omit for authenticated user's gists) (string, optional)
update_gist - Update Gist
Required OAuth Scopes: gist
content: Content for the file (string, required)
description: Updated description of the gist (string, optional)
filename: Filename to update or create (string, required)
gist_id: ID of the gist to update (string, required)
get_repository_tree - Get repository tree
Required OAuth Scopes: repo
owner: Repository owner (username or organization) (string, required)
path_filter: Optional path prefix to filter the tree results (e.g., 'src/' to only show files in the src directory) (string, optional)
recursive: Setting this parameter to true returns the objects or subtrees referenced by the tree. Default is false (boolean, optional)
repo: Repository name (string, required)
tree_sha: The SHA1 value or ref (branch or tag) name of the tree. Defaults to the repository's default branch (string, optional)
add_issue_comment - Add comment to issue or pull request
Required OAuth Scopes: repo
body: Comment content. Required unless reaction is provided. (string, optional)
comment_id: The numeric ID of the issue or pull request comment to react to. Use this for reactions to comments; omit it to react to the issue or pull request itself. Cannot be combined with body. (number, optional)
issue_number: Issue or pull request number to comment on or react to. (number, required)
owner: Repository owner (string, required)
reaction: Emoji reaction to add. Required unless body is provided. (string, optional)
repo: Repository name (string, required)
get_label - Get a specific label from a repository
Required OAuth Scopes: repo
name: Label name. (string, required)
owner: Repository owner (username or organization name) (string, required)
repo: Repository name (string, required)
issue_read - Get issue details
Required OAuth Scopes: repo
issue_number: The number of the issue (number, required)
method: The read operation to perform on a single issue.
Options are:
get - Get issue details. Also returns best-effort hierarchy flags (has_parent, has_children); parent and sub_issues_summary are optional relationship summaries.
get_comments - Get issue comments.
get_sub_issues - Get sub-issues (children) of the issue.
get_parent - Get the parent issue, if this issue is a sub-issue of another.
get_labels - Get labels assigned to the issue.
(string, required)
owner: The owner of the repository (string, required)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
repo: The name of the repository (string, required)
issue_write - Create or update issue/pull request
Required OAuth Scopes: repo
assignees: Usernames to assign to this issue (string[], optional)
body: Issue body content (string, optional)
duplicate_of: Issue number that this issue is a duplicate of. Only used when state_reason is 'duplicate'. (number, optional)
issue_fields: Issue field values to set or clear. Each item requires 'field_name' and exactly one of 'value', 'field_option_name', or 'delete: true'. (object[], optional)
issue_number: Issue number to update (number, optional)
labels: Labels to apply to this issue (string[], optional)
method: Write operation to perform on a single issue.
Options are:
'create' - creates a new issue.
'update' - updates an existing issue.
(string, required)
milestone: Milestone number (number, optional)
owner: Repository owner (string, required)
repo: Repository name (string, required)
state: New state (string, optional)
state_reason: Reason for the state change. Ignored unless state is changed. (string, optional)
title: Issue title (string, optional)
type: Type of this issue. Only use if issue types are enabled for this repository. Use list_issue_types tool to get valid type values for this repository or its owner organization. If the repository doesn't support issue types, omit this parameter. (string, optional)
owner: The account owner of the repository or organization. The name is not case sensitive. (string, required)
repo: The name of the repository. When provided, returns fields for this specific repository (inherited from its organization). When omitted, returns org-level fields directly. (string, optional)
owner: The account owner of the repository or organization. (string, required)
repo: The name of the repository. When provided, returns issue types for this specific repository. When omitted, returns org-level issue types directly. (string, optional)
list_issues - List issues
Required OAuth Scopes: repo
after: Cursor for pagination. Use the cursor from the previous response. (string, optional)
direction: Order direction. If provided, the 'orderBy' also needs to be provided. (string, optional)
field_filters: Filter by custom issue field values. Each entry takes a field_name and a value; the server looks up the field and coerces the value to its type (single-select option name, text, number, or YYYY-MM-DD date). (object[], optional)
labels: Filter by labels (string[], optional)
orderBy: Order issues by field. If provided, the 'direction' also needs to be provided. (string, optional)
owner: Repository owner (string, required)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
repo: Repository name (string, required)
since: Filter by date (ISO 8601 timestamp) (string, optional)
state: Filter by state, by default both open and closed issues are returned when not provided (string, optional)
search_issues - Search issues
Required OAuth Scopes: repo
order: Sort order (string, optional)
owner: Optional repository owner. If provided with repo, only issues for this repository are listed. (string, optional)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
query: Search query using GitHub issues search syntax (string, required)
repo: Optional repository name. If provided with owner, only issues for this repository are listed. (string, optional)
sort: Sort field by number of matches of categories, defaults to best match (string, optional)
sub_issue_write - Change sub-issue
Required OAuth Scopes: repo
after_id: The ID of the sub-issue to be prioritized after (either after_id OR before_id should be specified) (number, optional)
before_id: The ID of the sub-issue to be prioritized before (either after_id OR before_id should be specified) (number, optional)
issue_number: The number of the parent issue (number, required)
method: The action to perform on a single sub-issue
Options are:
'add' - add a sub-issue to a parent issue in a GitHub repository.
'remove' - remove a sub-issue from a parent issue in a GitHub repository.
'reprioritize' - change the order of sub-issues within a parent issue in a GitHub repository. Use either 'after_id' or 'before_id' to specify the new position.
Writes issue hierarchy. To move a sub-issue to a new parent, use add with replace_parent=true; there is no writable parent field.
(string, required)
owner: Repository owner (string, required)
replace_parent: When true, replaces the sub-issue's current parent issue. Use with 'add' method only. (boolean, optional)
repo: Repository name (string, required)
sub_issue_id: The ID of the sub-issue to add. ID is not the same as issue number (number, required)
get_label - Get a specific label from a repository
Required OAuth Scopes: repo
name: Label name. (string, required)
owner: Repository owner (username or organization name) (string, required)
repo: Repository name (string, required)
label_write - Write operations on repository labels
Required OAuth Scopes: repo
color: Label color as 6-character hex code without '#' prefix (e.g., 'f29513'). Required for 'create', optional for 'update'. (string, optional)
description: Label description text. Optional for 'create' and 'update'. (string, optional)
method: Operation to perform: 'create', 'update', or 'delete' (string, required)
name: Label name - required for all operations (string, required)
new_name: New name for the label (used only with 'update' method to rename) (string, optional)
owner: Repository owner (username or organization name) (string, required)
repo: Repository name (string, required)
list_label - List labels from a repository
Required OAuth Scopes: repo
owner: Repository owner (username or organization name) - required for all operations (string, required)
repo: Repository name - required for all operations (string, required)
dismiss_notification - Dismiss notification
Required OAuth Scopes: notifications
state: The new state of the notification (read/done) (string, required)
threadID: The ID of the notification thread (string, required)
get_notification_details - Get notification details
Required OAuth Scopes: notifications
notificationID: The ID of the notification (string, required)
list_notifications - List notifications
Required OAuth Scopes: notifications
before: Only show notifications updated before the given time (ISO 8601 format) (string, optional)
filter: Filter notifications to, use default unless specified. Read notifications are ones that have already been acknowledged by the user. Participating notifications are those that the user is directly involved in, such as issues or pull requests they have commented on or created. (string, optional)
owner: Optional repository owner. If provided with repo, only notifications for this repository are listed. (string, optional)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
repo: Optional repository name. If provided with owner, only notifications for this repository are listed. (string, optional)
since: Only show notifications updated after the given time (ISO 8601 format) (string, optional)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
query: Organization search query. Examples: 'microsoft', 'location:california', 'created:>=2025-01-01'. Search is automatically scoped to type:org. (string, required)
sort: Sort field by category (string, optional)
projects_get - Get details of GitHub Projects resources
Required OAuth Scopes: read:project
Accepted OAuth Scopes: project, read:project
field_id: The field's ID. Required for 'get_project_field' method. (number, optional)
fields: Specific list of field IDs to include in the response when getting a project item (e.g. ["102589", "985201", "169875"]). If not provided, only the title field is included. Only used for 'get_project_item' method. (string[], optional)
item_id: The item's ID. Required for 'get_project_item' method. (number, optional)
method: The method to execute (string, required)
owner: The owner (user or organization login). The name is not case sensitive. (string, optional)
owner_type: Owner type (user or org). If not provided, will be automatically detected. (string, optional)
project_number: The project's number. (number, optional)
status_update_id: The node ID of the project status update. Required for 'get_project_status_update' method. (string, optional)
projects_list - List GitHub Projects resources
Required OAuth Scopes: read:project
Accepted OAuth Scopes: project, read:project
after: Forward pagination cursor from previous pageInfo.nextCursor. (string, optional)
before: Backward pagination cursor from previous pageInfo.prevCursor (rare). (string, optional)
fields: Field IDs to include when listing project items (e.g. ["102589", "985201"]). CRITICAL: Always provide to get field values. Without this, only titles returned. Only used for 'list_project_items' method. (string[], optional)
method: The action to perform (string, required)
owner: The owner (user or organization login). The name is not case sensitive. (string, required)
owner_type: Owner type (user or org). If not provided, will automatically try both. (string, optional)
per_page: Results per page (max 50) (number, optional)
project_number: The project's number. Required for 'list_project_fields', 'list_project_items', and 'list_project_status_updates' methods. (number, optional)
query: Filter/query string. For list_projects: filter by title text and state (e.g. "roadmap is:open"). For list_project_items: advanced filtering using GitHub's project filtering syntax. (string, optional)
projects_write - Manage GitHub Projects
Required OAuth Scopes: project
body: The body of the status update (markdown). Used for 'create_project_status_update' method. (string, optional)
field_name: The name of the iteration field (e.g. 'Sprint'). Required for 'create_iteration_field' method. (string, optional)
issue_number: The issue number (use when item_type is 'issue' for 'add_project_item' method). Provide either issue_number or pull_request_number. (number, optional)
item_id: The project item ID. Required for 'update_project_item' and 'delete_project_item' methods. (number, optional)
item_owner: The owner (user or organization) of the repository containing the issue or pull request. Required for 'add_project_item' method. (string, optional)
item_repo: The name of the repository containing the issue or pull request. Required for 'add_project_item' method. (string, optional)
item_type: The item's type, either issue or pull_request. Required for 'add_project_item' method. (string, optional)
iteration_duration: Duration in days for iterations of the field (e.g. 7 for weekly, 14 for bi-weekly). Required for 'create_iteration_field' method. (number, optional)
iterations: Custom iterations for 'create_iteration_field' method. Only set this when you need iterations with varying durations, breaks between them, or specific titles. Otherwise omit it: GitHub auto-creates three iterations of 'iteration_duration' days starting on 'start_date', which is the right choice for most cases. (object[], optional)
method: The method to execute (string, required)
owner: The project owner (user or organization login). The name is not case sensitive. (string, required)
add_comment_to_pending_review - Add review comment to the requester's latest pending pull request review
Required OAuth Scopes: repo
body: The text of the review comment (string, required)
line: The line of the blob in the pull request diff that the comment applies to. For multi-line comments, the last line of the range (number, optional)
owner: Repository owner (string, required)
path: The relative path to the file that necessitates a comment (string, required)
pullNumber: Pull request number (number, required)
repo: Repository name (string, required)
side: The side of the diff to comment on. LEFT indicates the previous state, RIGHT indicates the new state (string, optional)
startLine: For multi-line comments, the first line of the range that the comment applies to (number, optional)
startSide: For multi-line comments, the starting side of the diff that the comment applies to. LEFT indicates the previous state, RIGHT indicates the new state (string, optional)
subjectType: The level at which the comment is targeted (string, required)
add_reply_to_pull_request_comment - Add reply to pull request comment
Required OAuth Scopes: repo
body: The text of the reply. Required unless reaction is provided. (string, optional)
commentId: The numeric ID of the pull request review comment to reply or react to. Use the number from a #discussion_r... anchor, not the GraphQL thread node ID (PRRT_...). (number, required)
owner: Repository owner (string, required)
pullNumber: Pull request number. Required when body is provided. (number, optional)
reaction: Emoji reaction to add. Required unless body is provided. (string, optional)
reviewers: GitHub usernames or ORG/team-slug team reviewers to request reviews from (string[], optional)
title: PR title (string, required)
list_pull_requests - List pull requests
Required OAuth Scopes: repo
base: Filter by base branch (string, optional)
direction: Sort direction (string, optional)
head: Filter by head user/org and branch (string, optional)
owner: Repository owner (string, required)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
repo: Repository name (string, required)
sort: Sort by (string, optional)
state: Filter by state (string, optional)
merge_pull_request - Merge pull request
Required OAuth Scopes: repo
commit_message: Extra detail for merge commit (string, optional)
commit_title: Title for merge commit (string, optional)
merge_method: Merge method (string, optional)
owner: Repository owner (string, required)
pullNumber: Pull request number (number, required)
repo: Repository name (string, required)
pull_request_read - Get details for a single pull request
Required OAuth Scopes: repo
after: Cursor for pagination, used only by the get_review_comments method. Pass the endCursor from the previous page's PageInfo to fetch the next page. (string, optional)
method: Action to specify what pull request data needs to be retrieved from GitHub.
Possible options:
get - Get details of a specific pull request.
get_diff - Get the diff of a pull request.
get_status - Get combined commit status of a head commit in a pull request.
get_files - Get the list of files changed in a pull request. Use with pagination parameters to control the number of results returned.
get_commits - Get the list of commits on a pull request. Use with pagination parameters to control the number of results returned.
get_review_comments - Get review threads on a pull request. Each thread contains logically grouped review comments made on the same code location during pull request reviews. Returns threads with metadata (isResolved, isOutdated, isCollapsed) and their associated comments. Use cursor-based pagination (perPage, after) to control results.
get_reviews - Get the reviews on a pull request. When asked for review comments, use get_review_comments method. Use with pagination parameters to control the number of results returned.
get_comments - Get comments on a pull request. Use this if user doesn't specifically want review comments. Use with pagination parameters to control the number of results returned.
get_check_runs - Get check runs for the head commit of a pull request. Check runs are the individual CI/CD jobs and checks that run on the PR.
(string, required)
owner: Repository owner (string, required)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
pullNumber: Pull request number (number, required)
commitID: SHA of commit to review (string, optional)
event: Review action to perform. (string, optional)
method: The write operation to perform on pull request review. (string, required)
owner: Repository owner (string, required)
pullNumber: Pull request number (number, required)
repo: Repository name (string, required)
threadId: The node ID of the review thread (e.g., PRRT_kwDOxxx). Required for resolve_thread and unresolve_thread methods. Get thread IDs from pull_request_read with method get_review_comments. (string, optional)
search_pull_requests - Search pull requests
Required OAuth Scopes: repo
order: Sort order (string, optional)
owner: Optional repository owner. If provided with repo, only pull requests for this repository are listed. (string, optional)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
organization: Organization to create the repository in (omit to create in your personal account) (string, optional)
private: Whether the repository should be private. Defaults to true (private) when omitted. (boolean, optional)
delete_file - Delete file
Required OAuth Scopes: repo
branch: Branch to delete the file from (string, required)
message: Commit message (string, required)
owner: Repository owner (username or organization) (string, required)
path: Path to the file to delete (string, required)
repo: Repository name (string, required)
fork_repository - Fork repository
Required OAuth Scopes: repo
organization: Organization to fork to (string, optional)
owner: Repository owner (string, required)
repo: Repository name (string, required)
get_commit - Get commit details
Required OAuth Scopes: repo
detail: Level of detail to include for changed files. "none" omits stats and files entirely. "stats" (default) includes per-file metadata: filename, status, and lines-of-code counts (additions, deletions, changes), with no patch content. "full_patch" additionally includes the unified diff content for each file and can be very large. (string, optional)
owner: Repository owner (string, required)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
repo: Repository name (string, required)
sha: Commit SHA, branch name, or tag name (string, required)
get_file_contents - Get file or directory contents
Required OAuth Scopes: repo
owner: Repository owner (username or organization) (string, required)
path: Path to file/directory (string, optional)
ref: Accepts optional git refs such as refs/tags/{tag}, refs/heads/{branch} or refs/pull/{pr_number}/head (string, optional)
repo: Repository name (string, required)
sha: Accepts optional commit SHA. If specified, it will be used instead of ref (string, optional)
get_latest_release - Get latest release
Required OAuth Scopes: repo
owner: Repository owner (string, required)
repo: Repository name (string, required)
get_release_by_tag - Get a release by tag name
Required OAuth Scopes: repo
owner: Repository owner (string, required)
repo: Repository name (string, required)
tag: Tag name (e.g., 'v1.0.0') (string, required)
get_tag - Get tag details
Required OAuth Scopes: repo
owner: Repository owner (string, required)
repo: Repository name (string, required)
tag: Tag name (string, required)
list_branches - List branches
Required OAuth Scopes: repo
owner: Repository owner (string, required)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
repo: Repository name (string, required)
list_commits - List commits
Required OAuth Scopes: repo
author: Author username or email address to filter commits by (string, optional)
owner: Repository owner (string, required)
page: Page number for pagination (min 1) (number, optional)
path: Only commits containing this file path will be returned (string, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
repo: Repository name (string, required)
sha: Commit SHA, branch or tag name to list commits of. If not provided, uses the default branch of the repository. If a commit SHA is provided, will list commits up to that SHA. (string, optional)
since: Only commits after this date will be returned (ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ or YYYY-MM-DD) (string, optional)
until: Only commits before this date will be returned (ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ or YYYY-MM-DD) (string, optional)
list_releases - List releases
Required OAuth Scopes: repo
owner: Repository owner (string, required)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
repo: Repository name (string, required)
list_repository_collaborators - List repository collaborators
Required OAuth Scopes: repo
affiliation: Filter by affiliation. Can be one of: 'outside' (outside collaborators), 'direct' (all with permissions regardless of org membership), 'all' (all collaborators). Default: 'all' (string, optional)
owner: Repository owner (string, required)
page: Page number for pagination (default 1, min 1) (number, optional)
perPage: Results per page for pagination (default 30, min 1, max 100) (number, optional)
repo: Repository name (string, required)
list_tags - List tags
Required OAuth Scopes: repo
owner: Repository owner (string, required)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
repo: Repository name (string, required)
push_files - Push files to repository
Required OAuth Scopes: repo
branch: Branch to push to (string, required)
files: Array of file objects to push, each object with path (string) and content (string) (object[], required)
message: Commit message (string, required)
owner: Repository owner (string, required)
repo: Repository name (string, required)
search_code - Search code
Required OAuth Scopes: repo
order: Sort order for results (string, optional)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
query: Commit search query (GitHub commit search REST). Searches commit messages on the default branch only. Scope the search with repo:owner/repo, org:, or user: (queries without a scope qualifier match across all of GitHub and are usually not what you want). Other qualifiers: author:, committer:, author-name:, committer-name:, author-email:, committer-email:, author-date:, committer-date: (supports >, <, >=, <=, and YYYY-MM-DD..YYYY-MM-DD ranges), merge:true|false, hash:, , , . Examples: ; ; ; . (string, required)
search_repositories - Search repositories
Required OAuth Scopes: repo
minimal_output: Return minimal repository information (default: true). When false, returns full GitHub API repository objects. (boolean, optional)
order: Sort order (string, optional)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
sort: Sort repositories by field, defaults to best match (string, optional)
get_secret_scanning_alert - Get secret scanning alert
Required OAuth Scopes: security_events
Accepted OAuth Scopes: repo, security_events
alertNumber: The number of the alert. (number, required)
owner: The owner of the repository. (string, required)
repo: The name of the repository. (string, required)
list_secret_scanning_alerts - List secret scanning alerts
Required OAuth Scopes: security_events
Accepted OAuth Scopes: repo, security_events
owner: The owner of the repository. (string, required)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
repo: The name of the repository. (string, required)
resolution: Filter by resolution (string, optional)
secret_type: A comma-separated list of secret types to return. All default secret patterns are returned. To return generic patterns, pass the token name(s) in the parameter. (string, optional)
state: Filter by state (string, optional)
get_global_security_advisory - Get a global security advisory
Required OAuth Scopes: security_events
Accepted OAuth Scopes: repo, security_events
ghsaId: GitHub Security Advisory ID (format: GHSA-xxxx-xxxx-xxxx). (string, required)
list_global_security_advisories - List global security advisories
Required OAuth Scopes: security_events
Accepted OAuth Scopes: repo, security_events
affects: Filter advisories by affected package or version (e.g. "package1,package2@1.0.0"). (string, optional)
cveId: Filter by CVE ID. (string, optional)
cwes: Filter by Common Weakness Enumeration IDs (e.g. ["79", "284", "22"]). (string[], optional)
ecosystem: Filter by package ecosystem. (string, optional)
ghsaId: Filter by GitHub Security Advisory ID (format: GHSA-xxxx-xxxx-xxxx). (string, optional)
isWithdrawn: Whether to only return withdrawn advisories. (boolean, optional)
modified: Filter by publish or update date or date range (ISO 8601 date or range). (string, optional)
published: Filter by publish date or date range (ISO 8601 date or range). (string, optional)
severity: Filter by severity. (string, optional)
type: Advisory type. (string, optional)
updated: Filter by update date or date range (ISO 8601 date or range). (string, optional)
list_org_repository_security_advisories - List org repository security advisories
Required OAuth Scopes: security_events
Accepted OAuth Scopes: repo, security_events
direction: Sort direction. (string, optional)
org: The organization login. (string, required)
sort: Sort field. (string, optional)
state: Filter by advisory state. (string, optional)
list_repository_security_advisories - List repository security advisories
Required OAuth Scopes: security_events
Accepted OAuth Scopes: repo, security_events
direction: Sort direction. (string, optional)
owner: The owner of the repository. (string, required)
repo: The name of the repository. (string, required)
sort: Sort field. (string, optional)
state: Filter by advisory state. (string, optional)
list_starred_repositories - List starred repositories
Required OAuth Scopes: repo
direction: The direction to sort the results by. (string, optional)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
sort: How to sort the results. Can be either 'created' (when the repository was starred) or 'updated' (when the repository was last pushed to). (string, optional)
username: Username to list starred repositories for. Defaults to the authenticated user. (string, optional)
star_repository - Star repository
Required OAuth Scopes: repo
owner: Repository owner (string, required)
repo: Repository name (string, required)
unstar_repository - Unstar repository
Required OAuth Scopes: repo
owner: Repository owner (string, required)
repo: Repository name (string, required)
search_users - Search users
Required OAuth Scopes: repo
order: Sort order (string, optional)
page: Page number for pagination (min 1) (number, optional)
perPage: Results per page for pagination (min 1, max 100) (number, optional)
query: User search query. Examples: 'john smith', 'location:seattle', 'followers:>100'. Search is automatically scoped to type:user. (string, required)
sort: Sort users by number of followers or repositories, or when the person joined GitHub. (string, optional)
Additional Tools in Remote GitHub MCP Server
create_pull_request_with_copilot - Perform task with GitHub Copilot coding agent
owner: Repository owner. You can guess the owner, but confirm it with the user before proceeding. (string, required)
repo: Repository name. You can guess the repository name, but confirm it with the user before proceeding. (string, required)
problem_statement: Detailed description of the task to be performed (e.g., 'Implement a feature that does X', 'Fix bug Y', etc.) (string, required)
title: Title for the pull request that will be created (string, required)
base_ref: Git reference (e.g., branch) that the agent will start its work from. If not specified, defaults to the repository's default branch (string, optional)
Authentication note
Fine-grained PATs are not hidden by classic PAT scope filtering, so these tools may still appear even when the token cannot use them.
For org-owned spaces, fine-grained PATs must be installed on the owning organization and include organization_copilot_spaces: read.
If an org-owned space contains repository-backed resources, the token must also have access to every referenced repository or the space may be treated as not found.
get_copilot_space - Get Copilot Space
owner: The owner of the space. (string, required)
name: The name of the space. (string, required)
list_copilot_spaces - List Copilot Spaces
github_support_docs_search - Retrieve documentation relevant to answer GitHub product and support questions. Support topics include: GitHub Actions Workflows, Authentication, GitHub Support Inquiries, Pull Request Practices, Repository Maintenance, GitHub Pages, GitHub Packages, GitHub Discussions, Copilot Spaces
query: Input from the user about the question they need answered. This is the latest raw unedited user message. You should ALWAYS leave the user message as it is, you should never modify it. (string, required)
Alternatively, to manually configure VS Code, choose the appropriate JSON block from the examples below and add it to your host configuration:
Rovo Dev CLI - Installation guide for Rovo Dev CLI
Note: Each MCP host application needs to configure a GitHub App or OAuth App to support remote access via OAuth. Any host application that supports remote MCP servers should support the remote GitHub server with PAT authentication. Configuration details and support levels vary by host. Make sure to refer to the host application's documentation for more info.
Configuration
Toolset configuration
See Remote Server Documentation for full details on remote server configuration, toolsets, headers, and advanced usage. This file provides comprehensive instructions and examples for connecting, customizing, and installing the remote GitHub MCP Server in VS Code and other MCP hosts.
Note: When using OAuth with GitHub Enterprise with VS Code and GitHub Copilot, you also need to configure your VS Code settings to point to your GitHub Enterprise instance - see Authenticate from VS Code
owner_type: Owner type (user or org). Required for 'create_project' method. If not provided for other methods, will be automatically detected. (string, optional)
project_number: The project's number. Required for all methods except 'create_project'. (number, optional)
pull_request_number: The pull request number (use when item_type is 'pull_request' for 'add_project_item' method). Provide either issue_number or pull_request_number. (number, optional)
start_date: Start date in YYYY-MM-DD format. Used for 'create_project_status_update' and 'create_iteration_field' methods. (string, optional)
status: The status of the project. Used for 'create_project_status_update' method. (string, optional)
target_date: The target date of the status update in YYYY-MM-DD format. Used for 'create_project_status_update' method. (string, optional)
title: The project title. Required for 'create_project' method. (string, optional)
updated_field: Object consisting of the ID of the project field to update and the new value for the field. To clear the field, set value to null. Example: {"id": 123456, "value": "New Value"}. Required for 'update_project_item' method. (object, optional)
NOT TODO language:go repo:o/r
sort: Sort field ('indexed' only) (string, optional)
