GitHub MCP Server connects AI tools to GitHub through the Model Context Protocol, so an agent can browse repositories and code, create and update issues and pull requests, watch Actions workflow runs, and read security findings in one conversation instead of through separate integrations.
It runs two ways. The remote server is hosted by GitHub at https://api.githubcopilot.com/mcp/ and works with any host that supports remote MCP servers, authenticating over OAuth or a personal access token; GitHub Enterprise Cloud with data residency is reachable at a per-tenant URL. The local server runs as a Go binary or a container image and authenticates with a browser OAuth flow, a device-code fallback, your own OAuth or GitHub App, or a personal access token. Installation guides cover VS Code, Visual Studio, Copilot CLI and other Copilot IDEs, Claude Desktop and Claude Code, Codex, Cursor, OpenCode, Windsurf, Zed, and Rovo Dev CLI.
Capability is grouped into toolsets that you enable with --toolsets or GITHUBTOOLSETS, and individual tools can be added with --tools. Enabling only what you need reduces context size and narrows the model's tool choice. The default set is context, repos, issues, pullrequests, and users; all turns on everything. An insiders mode adds early-access and experimental tools on both the local and remote server.
Two safety switches limit what the server will do. Read-only mode registers only read tools and takes priority over any tool explicitly requested. Lockdown mode filters content from public repositories whose author lacks push access — some read tools return an error, others drop the untrusted entries — to reduce prompt-injection risk from issues, pull requests, comments, and commits. Content from github-actions[bot] and copilot is exempt. Lockdown mode is a content filter, not an authorization boundary: it does not change what the underlying credential can read or write. Tool descriptions can be overridden through a github-mcp-server-config.json file for translation or rewording, and the server name and title can be changed as well.
Features
- Hosted remote server: an HTTP endpoint with OAuth or token auth, requiring no local install
- Local server: a Go binary or container image with browser OAuth, device-code, GitHub App, or personal-access-token authentication
- Toolsets: actions, codequality, codesecurity, copilot, dependabot, discussions, gists, git, governance, issues, labels, notifications, orgs, projects, pullrequests, repos, secretprotection, security_advisories, stargazers, and users
- Fine-grained tool selection: --tools adds individual tools on top of a toolset, with renamed tools keeping their old names as aliases
- Read-only mode: registers only read tools, overriding any explicitly requested write tool
- Lockdown mode: filters or rejects public-repository content from authors without push access, as a prompt-injection mitigation
- Enterprise support: GitHub Enterprise Cloud with data residency on the remote server, and Enterprise Server through the local server
- Insiders mode: early-access tools through a URL path, header, flag, or environment variable
- Description overrides: a JSON config file rewrites tool descriptions, server name, and title for localisation
- Broad host coverage: installation guides for VS Code, Visual Studio, Copilot CLI, Claude, Codex, Cursor, OpenCode, Windsurf, Zed, and Rovo Dev CLI
