Quick Verdict
GitHub MCP Server is GitHub’s official open-source MCP product for connecting compatible hosts such as Claude, Cursor, Copilot, Codex, and OpenCode to repositories and code, issues, pull requests, Actions, notifications, projects, organizations, and security data. The current stable release is v1.6.0, published July 15, 2026 under MIT. Teams can use GitHub’s hosted remote HTTP endpoint or run the official container or binary locally.
It is recommended for organizations that already treat GitHub as an engineering system of record and can apply least privilege. It should not default to an all-repository write token. Begin with OAuth or a fine-grained PAT, a low-privilege test repository, --read-only, a minimal toolset/tool allowlist, and human approval. --lockdown-mode only filters selected public-repository issue and PR content from authors without push access. Private repositories are unaffected, and lockdown is not a general prompt-injection or authorization boundary.
Best For
- GitHub teams that want agents grounded in actual repository, issue, pull request, and CI state.
- Developer-platform teams able to operate separate OAuth/PAT identities, organization policies, approvals, and audit trails.
- Individual developers performing bounded read-only repository search or Actions investigation.
- It is not suitable for giving an unknown MCP host a personal token spanning every private repository and organization setting, or for unattended merges, releases, workflow triggers, and security changes.
Key Features
- Repository and code context: inspect files, trees, commits, branches, tags, and search results across authorized repositories.
- Issues and pull requests: read and manage issues, PRs, comments, reviews, labels, and relationships according to enabled tools and token permissions.
- Actions and security: optional toolsets cover workflows, code scanning, Dependabot, secret protection, advisories, and related engineering signals.
- Remote or local operation: use GitHub’s hosted remote server, the official
ghcr.io/github/github-mcp-serverimage, or a locally built Go binary. - OAuth or PAT: remote hosts can use OAuth; the local official image supports browser OAuth, while
GITHUB_PERSONAL_ACCESS_TOKENtakes precedence when supplied. - Surface control:
--toolsets/GITHUB_TOOLSETSselect groups, while--tools/GITHUB_TOOLSallow individual tools; the two selections are additive. - Read-only and lockdown: read-only removes write tools, while lockdown rejects or filters selected public contribution content based on author push access.
Use Cases
A low-risk pilot starts with repository Q&A: enable only context,repos, use an identity restricted to a test repository, and turn on --read-only. Pull-request assistance can add read operations from pull_requests, while treating model reviews as suggestions. If issue triage needs writes, allow specific read and comment tools instead of enabling all. Actions, organization, project, and security toolsets expand into CI, membership, planning, and vulnerability data and deserve separate permission reviews.
OAuth can avoid manually creating and storing a long-lived PAT, and the official local login flow can keep its token in process memory. Final authority still follows the user, OAuth/GitHub App, and organization policy. When PATs are necessary, use fine-grained tokens limited to repositories, permissions, and a short lifetime. Separate them by project and environment and rotate them. Never hardcode a token in MCP JSON, a repository .env, prompts, issues, or logs. If a host cannot reference secrets safely, fix secret delivery before connecting it.
Repository files, issues, PRs, reviews, comments, workflow logs, and release notes are untrusted content. Prompt injection may ask an agent to read private code, enumerate secrets, cross repository boundaries, or invoke a write tool. Token scope, read-only mode, and tool allowlists are independent controls; content cannot expand any of them. For branches, comments, closure, PR updates, workflow triggers, releases, and security changes, validate the owner and repository outside the model and show complete parameters at human confirmation.
Pricing
GitHub MCP Server v1.6.0 is free MIT-licensed software. Total cost includes the relevant GitHub plan and API allowance, MCP host, model tokens, local infrastructure, logging, and governance. GitHub hosts the remote endpoint, but capabilities depend on account and organization policy and each host’s OAuth support. GitHub Enterprise Server does not use GitHub’s hosted remote server and requires a local deployment. The v1.6.0 Insiders mode adds response fields filtering to selected tools, but Insiders remains an early-access surface.
| Mode | Authentication | Advantage | Main boundary |
|---|---|---|---|
| GitHub remote MCP | OAuth or PAT | Least installation; hosted by GitHub | Host OAuth support, organization policy, service availability |
| Official local container | OAuth or PAT | Pin an image and use stdio | User operates Docker, callback, secrets, and upgrades |
| Local Go binary | OAuth/PAT | Auditable build and runtime flags | Build integrity, signing, isolation, and maintenance are local duties |
| Insiders | OAuth/PAT | Early tools and selected response filtering | Schema and behavior can change; not a production default |
Pin v1.6.0 or its image digest and compare tool names, parameters, default toolsets, and permissions before upgrading. Continue monitoring security releases rather than freezing a vulnerable version. Remote service evolution also requires client regression tests for tool schemas.
Pros
- Officially maintained by GitHub, with authoritative repository-object and permission semantics.
- Stable v1.6.0 tag, container, and platform assets support pinning and audit.
- Hosted HTTP, local container, and binary modes fit different operating models.
- OAuth, PAT, read-only, toolsets, and per-tool allowlists can be combined for least privilege.
- Lockdown offers an additional filter for selected untrusted public contribution content.
- Broad issue, PR, Actions, and security context can ground engineering-agent decisions.
Cons
- A broad default or
allsurface can expose more read and write capability than the task needs. - Incorrect OAuth/PAT permissions can expose private repositories, organization data, workflow logs, and security findings.
- Lockdown does not apply the same filtering to private repositories and is not a general prompt-injection firewall.
- Remote and local servers both depend on GitHub APIs, network availability, and rate limits.
- Private code passes through the MCP host and model context; a local container does not automatically satisfy enterprise data boundaries.
- Write tools can comment, close, modify, or trigger real workflows and need parameter-level approval and audit.
Alternatives
| Tool | Better fit | Advantage | Main tradeoff |
|---|---|---|---|
| GitHub Copilot | GitHub teams wanting IDE completion, chat, agents, and administration | Complete managed developer product | Not a standalone composable MCP tool layer |
| Claude Code | Developers changing repositories and running tests in a terminal | Strong local coding execution loop | GitHub object support needs integration |
| Codex | Users delegating bounded coding work to OpenAI agents | Task execution and code-delivery workflow | Not a general GitHub API MCP server |
| Cursor | Teams wanting an AI-native IDE and codebase index | Mature daily editing and multi-file UX | Different GitHub tool surface and deployment control |
| Filesystem MCP Server | Agents requiring only a constrained local directory | Narrow scope without GitHub API access | No issues, PRs, Actions, or organization semantics |
FAQ
Is GitHub MCP Server v1.6.0 an official GitHub product?
Yes. GitHub maintains github/github-mcp-server; v1.6.0 was released July 15, 2026 and is MIT licensed.
Should authentication use OAuth or a PAT?
Prefer OAuth when the host supports it, reducing manual storage of long-lived tokens. For PATs, use fine-grained repository restrictions, minimum permissions, short expiry, and a secret manager.
Is --read-only enough for untrusted repositories?
No. It removes write tools, but hostile content can still attempt to induce unrelated reads or data disclosure. Also restrict repositories, token permissions, toolsets/tools, outputs, and model data handling.
Does lockdown mode protect private repositories?
Not with the public-contributor filtering described by GitHub. Private repositories are unaffected. Lockdown only rejects or filters selected issue and PR content in public repositories when the author lacks push access.
How can only a few tools be exposed?
Choose groups with --toolsets or GITHUB_TOOLSETS, then add exact tools with --tools or GITHUB_TOOLS. The selections are additive, while read-only takes precedence over write-tool registration.
Does private code remain local with the local server?
Not necessarily. GitHub results still pass through the server, MCP host, and selected model. Review logging, retention, training, region, and organization policy at every layer, and authorize only necessary repositories and files.
Bottom Line
GitHub MCP Server v1.6.0 is the leading official MCP option for connecting an agent to GitHub collaboration and engineering data. Its breadth is also its primary risk. Prefer OAuth or a fine-grained PAT, start with read-only and a minimal allowlist, do not mistake lockdown for prompt-injection protection, and enforce explicit boundaries, human confirmation, and audit for private code, cross-repository reads, and every write action.