GitHub MCP Server

The server uses one GitHub credential for everything: a personal access token, or by default an OAuth login that requests the full 'repo' scope (complete control of all the user's private repositories) plus packages, projects, gists and notifications. It narrows the default OAuth request by leaving out repository deletion, organization admin and workflow scopes, and it hides tools the token cannot use, but reads and writes share the same broad token and the server has no authorization layer of its own; GitHub's API is the only check. An opt-in GitHub App mode gives a dedicated, installation-scoped identity with short-lived tokens, which is the stronger option. In HTTP mode (not the scored default) the server forwards the client's bearer token to GitHub.

The host, not the server, decides what to approve, so this criterion rates the signals the server gives it. Every tool explicitly declares whether it is read-only, a test enforces that the declaration is present, reads and writes are separate tools, and the opt-in read-only mode drops every write tool. Repository deletion is the one action with a server-enforced human confirmation: the user must type the exact repository name and the server re-checks the repository's identity before deleting. Other destructive or hard-to-undo actions (merging, deleting files, pushing files, posting comments) have no preview or confirmation, and the interactive forms some clients show for creating issues and pull requests are not an enforced gate.

Tools are narrow, purpose-built GitHub operations rather than a generic HTTP or GraphQL passthrough. Write tools validate file paths (no absolute paths, backslashes or '..'), refuse to overwrite an existing file without its current SHA, refuse to write through symlinks, and never force-update branches. Read tools take paths and repository names without the same validation, and numeric limits such as page size live only in the schema. The default tool set includes many write tools (push files, delete files, create repositories, merge pull requests), and nothing limits which repositories or organizations the tools may touch.

The server never runs model-supplied code or commands. The only process it starts is the system browser opener for the OAuth login URL, and its only template rendering is the static OAuth result page. Actions it can trigger on GitHub (assigning the Copilot coding agent, or workflow runs in the non-default actions toolset) execute on GitHub's infrastructure and are scored as consequential actions under approval gates and untrusted input.

The server returns issue, pull request, comment, commit and file content from any repository, including public ones anyone can write to, and the same default session holds private-repository read access and write tools that post comments, open issues and push files. Results are structured JSON with authors and URLs, and issue and comment bodies are stripped of invisible characters, but nothing marks content as untrusted by default. The server already contains the right defenses — a lockdown mode that withholds public content from non-collaborators, information-flow labels that mark each result as trusted/untrusted and public/private, and a read-only mode — but all three are opt-in. As shipped, a hijacked agent can copy private code into a public comment with no human involved.

The server keeps no memory between sessions: OAuth tokens, caches and lockdown results live only in process memory, and configuration comes from flags and environment variables set by the operator. In the scored Docker deployment the working directory is inside the image, so no workspace file is loaded. In binary (non-Docker) installs, configuration loading is not integrity-protected.

The server loads no third-party code at runtime: no plugins, no MCP servers of its own, no downloaded tools. Its UI resources are embedded into the binary at build time.

The GitHub token never reaches the model: tools have no way to read it, OAuth tokens are held only in memory, and the token is attached only to requests for the configured GitHub hosts, so a redirect cannot carry it elsewhere. There is no redaction layer, though: the opt-in command logging writes every request and response verbatim, and the non-default secret-scanning tools deliberately return leaked secret values to the model. Default telemetry is a no-op. The token itself is long-lived and broad (a PAT, or an OAuth token with 'repo').

By default the server keeps no record of the tools it runs: it logs startup and authentication events only, and the per-tool logger it passes to handlers is never used. An opt-in command-logging flag writes the raw JSON-RPC traffic (every request and response) to stderr or a log file, which lets you reconstruct calls, but as unparsed byte chunks with no notion of who asked or who approved, written best-effort.

Some of the server's work is bounded: Actions log downloads are capped by a 5,000-line content window and default to the last 500 lines, list tools default to 30 results, and GitHub's own API rate limits bound a runaway. But GitHub API calls have no timeouts of their own, the log download ignores cancellation, page-size limits live only in the schema, and the server has no rate limiting. Assigning the Copilot coding agent starts remote work that continues regardless of anything the server or host does next.