The GitHub MCP Server is GitHub's own bridge between AI assistants and GitHub. Connect it to Claude, VS Code's Copilot agent mode, Cursor, Windsurf or any client that speaks the Model Context Protocol, and the assistant can browse and search code, read commits, open and update issues and pull requests, check Actions runs and failed builds, manage releases, and read security and Dependabot alerts, all from a chat.
There are two ways to run it. GitHub hosts a remote version at api.githubcopilot.com/mcp that you sign in to with OAuth or a personal access token; or you run the open-source server yourself from a Docker image or a Go binary. Either way you choose which toolsets are exposed, and a read-only mode removes every tool that can change anything.
It is MIT-licensed, written in Go, and maintained by GitHub with about 34,000 stars. The thing to understand before using it is that the assistant acts with whatever your token allows, and reads content that strangers can write.
- Repository: github.com/github/github-mcp-server
- Licence: MIT (MIT License)
- Language: Go. Stars: 34K. Forks: 5,231. Last push: Oct 23, 2026.
- Scan: safe, Oct 26, 2026, commit f385262
Who it is for
Developers who already use an AI assistant and want it to handle GitHub chores, such as triaging issues, summarizing pull requests or chasing a failing workflow, without copying and pasting between tabs.
Getting started
1. Add the local server to Claude Code with a personal access token (needs Docker)
claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=$GITHUB_PAT -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server2. Run it read-only, so the assistant can look but not change anything
docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN=<your-token> -e GITHUB_READ_ONLY=1 ghcr.io/github/github-mcp-serverVS Code 1.101 and later, Cursor and other hosts with remote MCP support can skip Docker and point at https://api.githubcopilot.com/mcp/ instead. Use --toolsets (or GITHUB_TOOLSETS) to expose only what you need, such as repos,issues.
Safety scan
We cloned github/github-mcp-server at commit f385262 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- The 29 token hits are all placeholders made of x's in two test files, pkg/http/middleware/pat_scope_test.go and token_test.go, which check how the server recognizes and scopes different GitHub token formats. No real token is present.
- The one pattern hit is script/lint, a developer script that pipes the golangci-lint installer to sh. It is not part of the server.
- 13 known advisories: 7 in ui/package-lock.json, the Vite and Zod build tooling for the server's small UI, and 6 in go.mod, including a moderate one in the chi router about trusting X-Forwarded-For for client IPs, which matters only if you run the HTTP mode behind a proxy and rely on client IPs.
- Every tool runs with your token. Content in public repositories, such as issue text or pull request comments, can contain instructions aimed at the AI; the server's lockdown mode hides content from authors without push access, but the project says plainly that it is a filter, not a permission boundary. A fine-grained token limited to the repositories you need is the real control.
- 13 workflows, none using pull_request_target, and all 10 third-party actions pinned to commits. Security policy, Dependabot, CodeQL, contributing guide and code of conduct all present.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | 29 candidates found and read; see the notes above. |
| Suspicious code | 1 pattern hit found and read; every one is listed under the raw findings. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 13 workflows. None use pull_request_target. 0 of 10 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, api.github.com, api.example.com, gist.github.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 13 advisories across 254 pinned packages: 0 critical, 2 high, 5 moderate, 1 low, 5 unrated. go.mod: 37 packages, 6 advisories; ui/package-lock.json: 217 packages, 7 advisories. |
| Project hygiene | Has security policy, automated dependency updates, CodeQL, licence file, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Secret candidates (29, redacted)
Pattern hits (1)
| Where | Rule | Match |
|---|---|---|
| script/lint:12 | download-piped-to-shell | curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b "$BINDIR" "$GOLANGCI_LINT_VERSION" |
Worst known vulnerabilities (13 of 13)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-587h-7wmj-h5pm | high | vite@8.3.2 | launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
| GHSA-mrhx-c7xc-m3w5 | high | zod@4.6.5 | Zod can exhaust memory while validating oversized constrained collections |
| GHSA-j6qf-3m9c-vwj3 | moderate | github.com/go-chi/chi/v5@5.3.2 | chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For |
| GHSA-698v-4r3x-3vcv | moderate | vite@8.3.2 | launch-editor: escapeCmdArgs() omits % escaping on Windows |
| GHSA-r825-w8mm-5pxw | moderate | vite@8.3.2 | launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
| GHSA-rq7h-c2jc-7f22 | moderate | vite@8.3.2 | Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
| GHSA-vfpm-58rq-9qcg | moderate | vite@8.3.2 | Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` |
| GHSA-9jrq-w75r-8gcw | low | vite@8.3.2 | Vite: Cross origin script execution through Vite custom middleware |
| CVE-2026-78659 | unknown | golang.org/x/net@0.59.0 | HTTP/2 server memory exhaustion due to Trailer headers in net/http |
| CVE-2026-78660 | unknown | golang.org/x/net@0.59.0 | HTTP/2 transport accepts malformed framing-related headers in net/http |
| CVE-2026-78669 | unknown | golang.org/x/net@0.59.0 | Excessive CPU consumption from repeated initial window changes in net/http |
| CVE-2026-78663 | unknown | golang.org/x/net@0.59.0 | Double flow control refund on HTTP/2 server streams in net/http |
| CVE-2026-97032 | unknown | golang.org/x/net@0.59.0 | HTTP/2 server crash due to HPACK encoder race in net/http |
By the numbers
| Stars | 34K |
|---|---|
| Forks | 5,231 |
| Contributors | 173 |
| Commits | 1,193 |
| Open issues | 209 |
| Open pull requests | 200 |
| Releases | 86 |
| Latest release | v2.0.3 |
| Licence | MIT |
| Main language | Go |
| Project age | 1 year |
| Last push | Oct 23, 2026 |
| Tracked files | 660 |
| Lines of code | 155.2K |
| Checkout size | 7 MB |
Lines by language: Go 140.5K, Markdown 8,154, TypeScript 4,861, YAML 1,152, JSON 197, HTML 176.
Questions
Is the GitHub MCP Server free?
Yes. The server is MIT-licensed and free to run yourself, and the remote server hosted by GitHub is available to GitHub accounts. Your AI client may have its own costs, and some organizations need a policy enabled before members can use the remote server.
Is it safe to give an AI assistant access to my GitHub?
It is as safe as the token you hand it. Use a fine-grained personal access token limited to specific repositories and permissions, start with --read-only, enable only the toolsets you use, and turn on lockdown mode if the assistant will read issues and comments from public repositories, where anyone can plant instructions.
What is the difference between the remote and the local server?
The remote server is hosted by GitHub at api.githubcopilot.com/mcp and supports OAuth sign-in, so there is nothing to install. The local server runs on your machine from Docker or a Go binary with a personal access token, works with any MCP client that launches local servers, and can point at GitHub Enterprise Server.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.