GitHub MCP Server

tl;dr: use GitHub’s server, not @modelcontextprotocol/server-github (archived). Easiest path in the README: remote MCP at https://api.githubcopilot.com/mcp/ (VS Code 1.101+ / hosts with remote MCP + OAuth). Local: Docker ghcr.io/github/github-mcp-server.

Host install notes they link: Cursor, Claude, Copilot CLI, Codex, OpenCode, Windsurf.

Remote (from their README)

{
  "servers": {
    "github": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp/"
    }
  }
}

PAT instead of OAuth: Authorization: Bearer <token> on that URL (see their README inputs example). Do not commit the token.

Local Docker + PAT

Image: ghcr.io/github/github-mcp-server. Env they document: GITHUB_PERSONAL_ACCESS_TOKEN (takes precedence over OAuth). They also mention GITHUB_PAT in a .env that you gitignore. Minimum scopes they list as examples: repo, read:packages, read:org — grant only what you need.

Enterprise: --gh-host / GITHUB_HOST (https:// required except loopback).

Toolsets (not a fake 15-tool dump)

The README groups capabilities: context, repos, issues, pull_requests, actions, code_security, secret_protection, dependabot, discussions, gists, notifications, orgs, projects, labels, users, stargazers, copilot, and more. Default toolset applies if you pass nothing. Flags: --toolsets, --tools, --read-only. Example tools they name: get_file_contents, issue_read, create_pull_request.

Lockdown mode in the README is a best-effort prompt-injection filter on untrusted issue/PR text. It is not an auth boundary.

Related: local Git MCP for a working copy on disk.

Stars/install counts are omitted until we fetch GitHub API this session. Untested here.