MCP serverPartly tested (needs an account)

Work with your GitHub projects

GitHub MCP Server

GitHub's official MCP server lets your agent read and manage repositories, issues, pull requests and Actions. It needs a token and Docker.

Works with
Claude Code, Codex CLI, Gemini CLI
Good for
Web developers, Everyone

What it does

This is GitHub's own MCP server. It gives your agent tools for GitHub: read files in a repository, list and create issues, read and review pull requests, check Actions runs.

Who it helps

People who manage projects on GitHub and want to ask for status or chores in plain words.

How to start

  1. Install Docker.
  2. Create a fine-grained token for one repository, with read access first.
  3. Run the install command.

Be careful

The agent acts with your token. A wide token is a big risk. Use the smallest rights. Texts from issues and pull requests can try to steer the agent, so do not approve write actions without reading them.

We did not start this server in our test. Read the README before you use it.

How to install

claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=$GITHUB_PAT -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server

How to use it

Create a token with only the rights you need, set it as GITHUB_PAT, then run the install command. Ask for tasks such as "list open issues labelled bug" or "summarise this pull request".

What to watch out for

  • The token gives the agent the same rights you gave the token. Use a fine-grained token limited to one repository and to read access where you can.
  • Write tools can create issues, comment, merge and change files. Approve them one by one.
  • Issue text from other people can contain hidden instructions for the agent.
  • The setup needs Docker.

Licence and author

Licence
MIT
Author
GitHub
Source code
github.com/github/github-mcp-server

How we tested it

We installed it on an empty test computer on 12 Oct 2026. Partly tested: installed in a clean test system, but its main features need an account or key we did not use.

Test level

The server was not started and no tools were listed. Everything about behaviour comes from the README, not from our test.

Technical details of the test
Date
12 Oct 2026
Method
Cloned the repository in a clean container with no account and read its files: the Gemini extension manifest is valid JSON. We did not start the server, because the install line needs Docker (not available in the sandbox) and a GitHub token.

Checked again on 12 Oct 2026

Sources