GitHub MCP Server: Complete Setup and Usage Guide 2026

The GitHub MCP Server bridges your AI coding tools with the GitHub API, enabling operations like repository management, issue tracking, pull request handling, and code search directly from your editor or CLI. This guide covers both the remote (hosted by GitHub) and local (Docker or binary) installation paths.

Prerequisites

A GitHub account

For the remote server: a compatible MCP host with remote server support (VS Code 1.101+, Claude Desktop, Cursor, Windsurf, etc.)

For the local server: Docker installed and running (or Go for building from source)

Any applicable policies enabled

Remote GitHub MCP Server

The remote server is hosted by GitHub at https://api.githubcopilot.com/mcp/ and requires no local installation. It's the easiest way to get started if your MCP host supports remote servers.

Install in VS Code

One-click install (VS Code 1.101+):


After installation, toggle Agent mode (located by the Copilot Chat text input) to start the server.

Manual configuration – add one of these JSON blocks to your VS Code MCP settings:

Using OAuthUsing a GitHub PAT

json { "servers": { "github": { "type": "http", "url": "https://api.githubcopilot.com/mcp/" } } } 

json { "servers": { "github": { "type": "http", "url": "https://api.githubcopilot.com/mcp/", "headers": { "Authorization": "Bearer ${input:github_mcp_pat}" } } }, "inputs": [{ "type": "promptString", "id": "github_mcp_pat", "description": "GitHub Personal Access Token", "password": true }] } 

Install in Other MCP Hosts

Refer to the official installation guides for your host:

Copilot CLI

GitHub Copilot in other IDEs (JetBrains, Visual Studio, Eclipse, Xcode)

Claude Applications

Codex

Cursor

OpenCode

Windsurf

Zed

Rovo Dev CLI

Note: Each MCP host configures its own GitHub App or OAuth App for remote OAuth support. PAT authentication works with any host that supports remote MCP servers. Check your host's documentation for details.

Insiders Mode (Remote)

Try new features early by using the insiders version:

Via URL PathVia Header

json { "servers": { "github": { "type": "http", "url": "https://api.githubcopilot.com/mcp/insiders" } } } 

json { "servers": { "github": { "type": "http", "url": "https://api.githubcopilot.com/mcp/", "headers": { "X-MCP-Insiders": "true" } } } } 

GitHub Enterprise (Remote)

Enterprise Cloud with data residency (ghe.com):

json
{
  "servers": {
    "github-octocorp": {
      "type": "http",
      "url": "https://copilot-api.octocorp.ghe.com/mcp",
      "headers": {
        "Authorization": "Bearer ${input:github_mcp_pat}"
      }
    }
  }
}

When using OAuth with VS Code and GitHub Copilot, also configure your VS Code settings to point to your GitHub Enterprise instance.

GitHub Enterprise Server does not support remote server hosting – use the local server instead.

Local GitHub MCP Server

Run the server locally via Docker or build from source. The Docker image is available at ghcr.io/github/github-mcp-server (public; if you get pull errors, run docker logout ghcr.io).

Authentication

OAuth (recommended): No token to create. The one-click Docker buttons publish a fixed callback port (127.0.0.1:8085) for the browser-based login flow. The token is kept in memory only. See Local Server OAuth Login for headless/device-code fallback and bringing your own OAuth app.

Personal Access Token (PAT): Set GITHUB_PERSONAL_ACCESS_TOKEN (takes precedence over OAuth). Create a token at https://github.com/settings/personal-access-tokens/new. Recommended minimum scopes: repo, read:packages, read:org.

Install in VS Code (Docker)

One-click install:


Manual configuration with OAuth:

json
{
  "mcp": {
    "servers": {
      "github": {
        "command": "docker",
        "args": [
          "run",
          "-i",
          "--rm",
          "-p",
          "127.0.0.1:8085:8085",
          "-e",
          "GITHUB_OAUTH_CALLBACK_PORT",
          "ghcr.io/github/github-mcp-server"
        ],
        "env": {
          "GITHUB_OAUTH_CALLBACK_PORT": "8085"
        }
      }
    }
  }
}

Manual configuration with PAT:

json
{
  "mcp": {
    "inputs": [
      {
        "type": "promptString",
        "id": "github_token",
        "description": "GitHub Personal Access Token",
        "password": true
      }
    ],
    "servers": {
      "github": {
        "command": "docker",
        "args": [
          "run",
          "-i",
          "--rm",
          "-e",
          "GITHUB_PERSONAL_ACCESS_TOKEN",
          "ghcr.io/github/github-mcp-server"
        ],
        "env": {
          "GITHUB_PERSONAL_ACCESS_TOKEN": "${input:github_token}"
        }
      }
    }
  }
}

You can also save the configuration (without the mcp key) to .vscode/mcp.json in your workspace for sharing with other hosts.

GitHub Enterprise Server and ghe.com (Local)

Use the --gh-host flag or GITHUB_HOST environment variable:

json
{
  "mcp": {
    "servers": {
      "github": {
        "command": "docker",
        "args": [
          "run",
          "-i",
          "--rm",
          "-e",
          "GITHUB_PERSONAL_ACCESS_TOKEN",
          "-e",
          "GITHUB_HOST",
          "ghcr.io/github/github-mcp-server"
        ],
        "env": {
          "GITHUB_PERSONAL_ACCESS_TOKEN": "${input:github_token}",
          "GITHUB_HOST": "https://"
        }
      }
    }
  }
}

For GitHub Enterprise Server, prefix the hostname with https:// (it defaults to http:// otherwise). For ghe.com, use https://YOURSUBDOMAIN.ghe.com.

Build from Source

If you don't have Docker, build the binary with Go:

bash
cd cmd/github-mcp-server
go build -o /path/to/github-mcp-server

Then configure your host to use the binary:

json
{
  "mcp": {
    "servers": {
      "github": {
        "command": "/path/to/github-mcp-server",
        "args": ["stdio"],
        "env": {
          "GITHUB_PERSONAL_ACCESS_TOKEN": ""
        }
      }
    }
  }
}

CLI Utilities

The binary includes helpful subcommands:

github-mcp-server tool-search "" – searches tools by name, description, and input parameters. Use --max-results to limit matches.

bash
docker run -it --rm ghcr.io/github/github-mcp-server tool-search "issue" --max-results 5

Tool Configuration

Control which GitHub API capabilities are available by specifying toolsets or individual tools. This helps the LLM with tool choice and reduces context size.

Default Toolset

When no toolsets are specified, the default set is used:

context

repos

issues

pull_requests

users

Specifying Toolsets

Via command line:

bash
github-mcp-server --toolsets repos,issues,pull_requests,actions,code_security

Via environment variable (takes precedence over CLI):

bash
GITHUB_TOOLSETS="repos,issues,pull_requests,actions,code_security" ./github-mcp-server

With Docker:

bash
docker run -i --rm \
  -e GITHUB_PERSONAL_ACCESS_TOKEN= \
  -e GITHUB_TOOLSETS="repos,issues,pull_requests,actions,code_security" \
  ghcr.io/github/github-mcp-server

Specifying Individual Tools

Via command line:

bash
github-mcp-server --tools get_file_contents,issue_read,create_pull_request

Via environment variable:

bash
GITHUB_TOOLS="get_file_contents,issue_read,create_pull_request" ./github-mcp-server

Combining toolsets and tools (additive):

bash
github-mcp-server --toolsets repos,issues --tools get_gist

With Docker:

bash
docker run -i --rm \
  -e GITHUB_PERSONAL_ACCESS_TOKEN= \
  -e GITHUB_TOOLSETS="repos,issues" \
  -e GITHUB_TOOLS="get_gist" \
  ghcr.io/github/github-mcp-server

Special Toolsets

all – enables all available toolsets: GITHUB_TOOLSETS="all" ./github-mcp-server

default – the default configuration. Add additional toolsets: GITHUB_TOOLSETS="default,stargazers" ./github-mcp-server

Important Notes

Tool names must match exactly (e.g., get_file_contents, not getFileContents). Invalid names cause startup failure.

Read-only mode (--read-only) takes priority: write tools are skipped even if explicitly requested.

Old tool names are preserved as aliases for backward compatibility.

Read-Only Mode

For security-sensitive environments, run the server in read-only mode to prevent any write operations:

bash
github-mcp-server --read-only

Or via environment variable:

bash
GITHUB_READ_ONLY=true ./github-mcp-server

Handling PATs Securely

Environment Variables (Recommended)

bash
export GITHUB_PAT=your_token_here

Or create a .env file:

env
GITHUB_PAT=your_token_here

Protect it: echo ".env" >> .gitignore

Reference in configurations:

bash
claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=$GITHUB_PAT -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server

Token Security Best Practices

Minimum scopes: Grant only necessary permissions (repo, read:packages, read:org)

Separate tokens: Use different PATs for different projects/environments

Regular rotation: Update tokens periodically

Never commit: Keep tokens out of version control

File permissions: Restrict access to config files: chmod 600 ~/.your-app/config.json

FAQ

1. Which authentication method should I use?

OAuth is the simplest for github.com – no token to create or store. Use a PAT if you need fine-grained permissions, want to avoid the browser login flow, or are using GitHub Enterprise Server.

2. Can I use the remote server with GitHub Enterprise Server?

No. GitHub Enterprise Server does not support remote server hosting. Use the local Docker server with GITHUB_HOST set to your GHES instance URL.

3. How do I enable only read operations?

Pass --read-only (or set GITHUB_READ_ONLY=true) to disable all write tools. This takes priority over any toolset or tool configuration.

4. What if my MCP host doesn't support remote servers?

Use the local Docker server. Any host that supports local MCP servers can run the Docker container. Configuration syntax varies by host – check your host's documentation.

5. How do I get early access to new features?

Use Insiders mode. For the remote server, use the /mcp/insiders URL path or set the X-MCP-Insiders: true header. For the local server, pass --insiders or set GITHUB_INSIDERS=true.

---

*Last updated: July 2026. Authoritative source: the official github/github-mcp-server repository.*