GitHub
The GitHub MCP server is GitHub's official Model Context Protocol server that lets AI agents read repositories and code, manage issues and pull… Setup config for Claude, Cursor and VS Code.
Project links
How to use it
- Open the listing page and read the server's documentation.
- Copy the configuration or command into your MCP client.
- Restart the client and try one of the server's tools.
Copy setup details
Use these instructions in your own environment. Copying text here does not run it.
MCP configuration 1
Copy into a client that accepts mcpServers JSON. Other clients may use a different configuration format.
{
"mcpServers": {
"github": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"GITHUB_PERSONAL_ACCESS_TOKEN",
"ghcr.io/github/github-mcp-server"
],
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "YOUR_GITHUB_TOKEN"
}
}
}
}Claude Code command
Run on your own machine to add this server to Claude Code.
claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=YOUR_GITHUB_PAT -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server
MCP configuration 2
Copy into a client that accepts mcpServers JSON. Other clients may use a different configuration format.
{
"mcpServers": {
"github": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"GITHUB_PERSONAL_ACCESS_TOKEN",
"ghcr.io/github/github-mcp-server"
],
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "YOUR_GITHUB_PAT"
}
}
}
}MCP configuration 3
Copy into a client that accepts mcpServers JSON. Other clients may use a different configuration format.
{
"mcpServers": {
"github": {
"url": "https://api.githubcopilot.com/mcp/",
"headers": {
"Authorization": "Bearer YOUR_GITHUB_PAT"
}
}
}
}Security checks
Automated checks, last run Nov 2, 2026. They can miss problems and do not guarantee a listing is safe. Read the source and what you are asked to run before you use it.
- Not checkedKnown vulnerabilities in the packageLayer 2
The setup does not install an npm or PyPI package, so no package vulnerabilities were looked up.
Source: OSV.dev
- PassedSetup commands and descriptionLayer 1
The install commands and description match none of the risky patterns we look for.
Source: AIWantsThis screening rules
- PassedSource repositoryLayer 2
The repository is public, not archived and has recent activity.
Evidence (3)
- Last push
- 2026-10-30
- Archived
- no
- License
- MIT
Source: GitHub