GitHub MCP server

What it does

GitHub's MCP server gives an agent the repositories, issues and pull requests that your token can reach, and it acts as the token's owner. GitHub hosts it at https://api.githubcopilot.com/mcp/, and the code is open source in github/github-mcp-server if you would rather run it yourself. With no extra settings it offers 46 tools. Another 45, including everything for Actions and security alerts, stay hidden until you ask for their toolset.

Tools

With no toolset selected, the server loads five toolsets: context, repos, issues, pull_requests and users. That gives these 46 tools.

You and your account

Repositories and code

Issues

Pull requests

Toolsets that are off by default

These 45 tools exist in the server but are not offered until you enable their toolset. The token also needs the matching repository permission, such as Actions or Dependabot alerts, or the calls fail at GitHub.

On the hosted server you pick toolsets with the X-MCP-Toolsets header, for example repos,issues,pull_requests,actions, or with a path such as https://api.githubcopilot.com/mcp/x/actions. Unknown toolset names are ignored without an error, so check the tool list after a change. X-MCP-Tools takes an exact list of tool names instead, and a misspelled name stops the server from starting. For read-only mode, send X-MCP-Readonly: true or add /readonly to the path. It drops every write tool, including the comment tools.

Set it up

The hosted server takes a personal access token as a bearer token. Create a fine-grained one under Settings → Developer settings → Fine-grained tokens. Give it access to only the repositories the agent should see. Set Contents, Issues and Pull requests to Read-only, plus Actions if you enable that toolset, and switch an area to Read and write only where the agent has to change something. Metadata is added automatically, and no account permissions are needed.

Claude Code, directly. GitHub's install guide uses add-json:

claude mcp add-json github '{"type":"http","url":"https://api.githubcopilot.com/mcp","headers":{"Authorization":"Bearer YOUR_GITHUB_PAT"}}'

Add "X-MCP-Toolsets" or "X-MCP-Readonly" to the headers object to change what loads. Where the token ends up and how scopes work is covered in How to add MCP servers to Claude Code.

Cursor, directly. In ~/.cursor/mcp.json:

{
  "mcpServers": {
    "github": {
      "url": "https://api.githubcopilot.com/mcp/",
      "headers": {
        "Authorization": "Bearer YOUR_GITHUB_PAT"
      }
    }
  }
}

More on the file and reloading it is in How to set up MCP servers in Cursor.

Through Statio. Install GitHub from the catalog and paste the token under Credentials. Then grant tools to yourself or to an agent under Permissions. Nothing is granted until you do. The desktop app writes the client config for you (mcphub config claude-code does it for Claude Code). By hand, both clients point at the local proxy with no token in the file:

claude mcp add --transport http github http://127.0.0.1:7777/github/mcp

In Cursor that is "url": "http://127.0.0.1:7777/github/mcp" with no headers. The path uses the server's name in your dashboard. Agents that run without a person need their own identity, which is set up as shown in Connect a client. If tools are missing after connecting, start with How to debug an MCP server that won't connect.

What to hold back

Every write lands under the token owner's name. A comment, an approval or a merge from the agent looks like you did it.

Coding agents. An agent that writes code needs create_branch, push_files and create_pull_request. Hold back merge_pull_request. With Contents set to write, the token can also push to the default branch unless a branch protection rule or ruleset blocks it, so set one up on GitHub's side. Hold back pull_request_review_write too. An approval from it counts as a review by the token owner, and if the agent is working with your token on someone else's pull request, that can meet a required-review rule nobody checked. Keep delete_file and create_repository away from it as well. New repositories are private by default, but the agent can pass private: false, and one push_files call later your code is public.

Triage agents. A bot that sorts incoming issues usually needs issue_read, search_issues, add_issue_comment, and some way to set labels. issue_write is the hard one. The same tool that sets a label also closes issues and marks them as duplicates, and the token permission can't separate the two. If the bot only comments, make add_issue_comment its only write tool. Read-only mode would remove that one too.

Anything that reads public content. search_code, search_issues and the read tools return text written by strangers, which can carry instructions aimed at your agent. Keep write tools away from agents that read untrusted repositories. GitHub's X-MCP-Lockdown header hides public content written by users without push access. GitHub describes it as a best-effort filter that does not change what the token can read or write.

Tools that start other work. assign_copilot_to_issue sets Copilot's coding agent to work on its own pull request. actions_run_trigger, once you enable actions, can run or cancel workflows, which may include your deploys.

Toolsets and read-only mode apply to everyone using that client config. Per-tool grants let one agent comment while another only reads, on the same server. See MCP permissions for how that works, and How to give an AI agent read-only GitHub access for the read-only setup step by step.

Questions