MCP server Official

GitHub MCP Server

GitHub's official MCP server for reading repos, managing issues and PRs, and monitoring Actions from AI tools.

Author
GitHub
Works with
Any MCP client, Claude Code, Cursor, OpenAI Codex, Windsurf
License
MIT
Documented
Oct 2, 2026

What GitHub MCP Server is

Connects AI tools to GitHub so agents can read repositories and code, manage issues and pull requests, analyze code and automate workflows. Available as a remote server hosted by GitHub or a local Docker server.

What it does

How GitHub MCP Server plugs in: which agents run it and what it addsRUNS INYour agentAny MCP clientClaude CodeOpenAI CodexCursor4 hosts documentedMCP SERVER · OFFICIALGitHub MCP ServerConnect the agent to tools, data…4 install steps1 permission notelicense: MITWHAT IT ADDSWhat it doesBrowse and search repositories, c…Create, update and manage issues…Monitor GitHub Actions runs and m…Review code security findings and…agent → extension → new capability · from the official repository or docs
Where GitHub MCP Server runs and what it adds, from its documentation
  • Browse and search repositories, code and commits
  • Create, update and manage issues and pull requests
  • Monitor GitHub Actions runs and manage releases
  • Review code security findings and Dependabot alerts
  • Access discussions and notifications
  • Limit tools with toolsets via --toolsets or --tools

When to use it

Good fit

  • Giving an agent GitHub context from VS Code, Claude, Codex, Cursor or Windsurf
  • Triaging issues and reviewing PRs in natural language
  • Debugging CI failures

Not for

  • Hosts without remote MCP support, unless you use the local Docker server
  • Setups where broad token scope is not acceptable

How to install GitHub MCP Server

You need: MCP host with remote server support (e.g. VS Code 1.101+, Claude Desktop, Cursor, Windsurf); Docker for the local server (image ghcr.io/github/github-mcp-server); GitHub OAuth login or personal access token

  1. Pick the remote server (https://api.githubcopilot.com/mcp/) or the local Docker server
  2. Follow the install guide for your host (Claude, Codex, Cursor, Windsurf, VS Code and others are linked in the README)
  3. Authenticate with OAuth or a GitHub personal access token
  4. Optionally restrict capabilities with toolsets
Configuration example (from the official docs)
{
  "servers": {
    "github": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp/"
    }
  }
}

Permissions and security

What it can access

  • Access to GitHub APIs per the token or OAuth scopes you grant

Security notes from the maintainers

  • README: enable only the token permissions you are comfortable granting
  • README has a Token Security Best Practices section: minimum scopes, store tokens in env variables, restrict config file permissions

Review the source before granting an agent access to credentials or production systems. We document what the maintainers state; we do not audit code.

Limitations

  • Each host must configure a GitHub App or OAuth App for remote OAuth
  • Support levels vary by host

Tools it extends

No user reviews yet

AI coding IDE, formerly Windsurf, now Devin Desktop: manage local and cloud coding agents inside a full IDE.

Free stops at: Light quota for agent usage, resets daily and weekly, Limited model availability

Listed Not yet reviewed

Verified windsurf.com (opens Devin Desktop (formerly Windsurf) website in a new tab)

Frequently asked questions

How do I connect GitHub MCP Server to Claude Code or Cursor?

Use the host-specific guides linked in the README (docs/installation-guides), pointing at the remote URL https://api.githubcopilot.com/mcp/ or the local Docker server. source

Does GitHub MCP Server need a personal access token?

Not necessarily; OAuth is supported, but a PAT can be used and takes precedence if GITHUB_PERSONAL_ACCESS_TOKEN is set. source

Can I limit what GitHub MCP Server exposes?

Yes, with the --toolsets flag or GITHUB_TOOLSETS variable, and --tools for single tools. source

Related guides

Sources and gaps

Not stated by the maintainers: last_release date not visible in the checked README.

More extensions to look at