20 Best GitHub MCP Servers, Compared (September 2026)
The short answer
For most readers, the server to reach for is GitHub MCP Server (github/github-mcp-server). It is GitHub's official MCP server, its README documents one-click install and OAuth/PAT configuration, and it has a commit 3 days ago and 201 commits on its default branch in the last 12 weeks. If the job is exploring an unfamiliar GitHub repository before editing, the better answer is github-codemunch-mcp, which indexes code into symbols and returns signatures and summaries instead of whole files, with a commit 0 days ago and 725 commits in the last 12 weeks.
Whichever you choose, give it the narrowest access that still works (a read-only credential, a replica, a scratch account), and widen it only once you have watched what your agent actually asks for.
Glama operates the MCP registry these numbers are measured from, and sells MCP hosting and a gateway. No position on this page is paid for. How the registry is built.
Quick picks
- 1GitHub MCP Server : Teams using VS Code 1.101 or later that want a remote MCP server hosted by GitHub: the README documents one-click install and OAuth/PAT configuration.
- 2github-codemunch-mcp : Exploring an unfamiliar GitHub repository before editing: it indexes code into symbols and returns signatures, summaries, and requested implementations instead of whole files.
- 3Octocode MCP : Code archaeology across local and GitHub repositories: it combines local ripgrep/LSP navigation with GitHub PR search and npm package lookup.
- 4idea-reality-mcp : Before starting a new project to check if it already exists: idea_check scans GitHub, npm, PyPI, Hacker News, and Stack Overflow for competitors.
- 5github-security-mcp : GitHub security audits spanning org settings, repos, Actions, secrets, supply chain, and access: it exposes 39 audit tools to AI agents.
Which one, for your situation
| Your situation | What to use |
|---|---|
| I need a hosted GitHub MCP server for VS Code | Use GitHub MCP Server (github/github-mcp-server), because it is GitHub's official server and its README documents one-click install and OAuth/PAT configuration. |
| Exploring an unfamiliar repository before editing without burning tokens | Use github-codemunch-mcp, because it indexes code into symbols and returns signatures and summaries instead of whole files, and it had a commit 0 days ago and 725 commits in the last 12 weeks. |
| Need a security audit across org settings, repos, and Actions | Use github-security-mcp, because it exposes 39 audit tools covering org settings, repositories, Actions workflows, secrets, supply chain, and access; it is labelled Abandoned but popular, so expect no commits in the last 12 weeks. |
| Want vulnerability checks before installing a dependency | Use deptrust, because it checks exact or latest package versions against OSV and GitHub Advisory DB and returns block, review, or allow, and it had a commit 11 days ago. |
| Want to search my starred repositories in natural language | Use GitHub Stars MCP Server, because it indexes your stars and READMEs and exposes a query tool for natural-language search, with a commit 1 day ago. |
| Need to triage CVEs during incident response | Use cve-mcp, because it unifies NVD, EPSS, CISA KEV, GitHub Advisory, and OSV for conversational queries and exposes 41 tools. |
Top MCP servers for GitHub
| Best for | Profile | ||||||
|---|---|---|---|---|---|---|---|
| 1 | Teams using VS Code 1.101 or later that want a remote MCP server hosted by GitHub: the README documents one-click install and OAuth/PAT configuration. | Community favourite | 32,587 | +781 | 3 days ago | 92.7 | |
| 2 | Exploring an unfamiliar GitHub repository before editing: it indexes code into symbols and returns signatures, summaries, and requested implementations instead of whole files. | Community favourite | 2,634 | +142 | today | 80.8 | |
| 3 | Code archaeology across local and GitHub repositories: it combines local ripgrep/LSP navigation with GitHub PR search and npm package lookup. | Community favourite | 920 | +23 | 5 days ago | 66.8 | |
| 4 | Before starting a new project to check if it already exists: idea_check scans GitHub, npm, PyPI, Hacker News, and Stack Overflow for competitors. | Community favourite | 808 | +39 | 19 days ago | 65.3 | |
| 5 | GitHub security audits spanning org settings, repos, Actions, secrets, supply chain, and access: it exposes 39 audit tools to AI agents. | Abandoned but popular | 12 | +2 | 169 days ago | 59.6 | |
| 6 | Debugging a cryptic error with an AI coding assistant: it returns StackOverflow, GitHub Issues, arXiv, and Wikipedia content as full conversations in a single call. | Community favourite | 379 | +17 | today | 58.3 | |
| 7 | For AI assistants needing accurate API usage from a niche GitHub library: it exposes the repo as a no-setup remote MCP endpoint. | Abandoned but popular | 8,332 | +75 | 114 days ago | 58.3 | |
| 8 | For incident response and CVE triage in an AI chat: 41 tools across NVD, EPSS, KEV, GitHub Advisory, OSV, Shodan, and exploit sources. | Emerging | 19 | +6 | 55 days ago | 57.0 | |
| 9 | For Claude Code, turning docs, repos, PDFs, videos, and code into AI skills and RAG knowledge: it exposes scrape, package, upload, and vector export tools. | Community favourite | 14,864 | +188 | 21 days ago | 54.3 | |
| 10 | Teams planning GitHub Projects V2 sprints and milestones: it exposes create, update, and metrics tools for projects, milestones, sprints, issues, and pull requests. | Steady | 95 | +1 | 20 days ago | 52.8 | |
| 11 | Developers wanting natural-language search over their own GitHub starred repositories: it indexes the stars and READMEs and exposes a query tool for them. | Steady | 112 | -1 | yesterday | 51.3 | |
| 12 | Building a product from a spec: its quickstart turns a PRD or one-line idea into a build with cost and time estimates before spending. | Community favourite | 1,050 | +25 | today | 49.5 | |
| 13 | Wrapping an existing MCP server in a security boundary: it proxies MCP traffic and scans bidirectionally for credential leaks, prompt injection, and tool description poisoning. | Community favourite | 822 | +41 | today | 49.0 | |
| 14 | Knowledge workers keeping personal notes and reusable prompts in Gists who want an AI client to edit them: it exposes gist, file, and comment tools. | Abandoned but popular | 202 | +2 | 226 days ago | 46.3 | |
| 15 | Claude Code users who want to activate and edit AI personas and skills: it exposes five tools covering create, read, update, delete, and execute. | Steady | 41 | +4 | 4 days ago | 45.8 | |
| 16 | Local Git repo management from an AI assistant in VS Code: it integrates with VS Code and covers basic and advanced Git workflows. | Dormant | 10 | 0 | 158 days ago | 45.6 | |
| 17 | A developer who needs GitHub API access through an MCP client: it enables file operations, repository management, and search functionality. | Abandoned but popular | 89,977 | +847 | 404 days ago | 45.5 | |
| 18 | Organizations that want to summarize discussions, issues, and pull requests beyond GitHub's 100-item API limit: it stores data locally and returns Markdown. | Dormant | 78 | 0 | 207 days ago | 45.3 | |
| 19 | For AI coding agents fixing static-analysis findings in context: it exposes security, dead-code, secrets, quality, and remediation tools with file paths and line numbers. | Community favourite | 544 | +37 | 5 days ago | 45.0 | |
| 20 | AI agent about to install a dependency: it checks exact or latest versions against OSV and GitHub Advisory DB, returning block, review, or allow. | Steady | 61 | +1 | 11 days ago | 44.7 |
The ranking, with the evidence
Each position is a weighted mean of adoption (40%), maintenance (24%), momentum (14%), tool description quality (13%) and trust (9%), multiplied by three attenuators: how directly the server is about GitHub (named for it, declaring it, tagged with it, or merely mentioning it), whether its repository is still moving, and how much independent evidence of adoption it has. Open the score on any entry to see every number, including the ones marked ≈, which were imputed from the median of the other candidates rather than measured. The maintenance grade on each entry is mostly issue responsiveness, release recency and open security alerts rather than commits, so a recent commit beside a low grade is two different measurements rather than a contradiction.
- Abandoned but popular: People use it, but its default branch has stopped moving. Fine to keep running, risky to adopt.
- Community favourite: Widely adopted and still actively maintained.
- Dormant: Neither changing nor widely adopted. Here because it still matches the search.
- Emerging: Small audience, growing quickly, maintained. The bet with the most upside.
- Steady: Maintained, modest audience, no surprises in either direction.
Best for: Teams using VS Code 1.101 or later that want a remote MCP server hosted by GitHub: the README documents one-click install and OAuth/PAT configuration.
The README presents a remote GitHub MCP server that connects AI tools to GitHub for reading code, managing issues and PRs, analyzing CI/CD, and automating workflows. A prerequisite is a compatible MCP host with remote server support and any applicable policies enabled.
GitHub stars32,587Stars / 30 days+781npm / typical weekShips no npm packageTools exposednever inspectedLast commit3 days agoCommits / 12 weeks201Maintenance gradeATool descriptionsNot gradedScore 92.7: show every number behind it
- Adoption100 / 100 · weight 40%
- GitHub stars100
- npm downloadsnot measuredno npm package
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance100 / 100 · weight 24%
- Last commit touching this server100
- Repository maintenance grade100
- Commit cadence100
- Momentum78 / 100 · weight 14%
- Stars gained, relative to size64
- Stars gained, absolute100
- npm download trendnot measuredno npm download history
- Tool quality≈68 / 100 · weight 13%
- Tool description quality≈68tool descriptions not yet scored
- Built and inspected by Glamanot measurednever built and inspected by Glama
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integrates100
- Weighted mean of the five
- 92.7
- × relevance: the keyword is dedicated here
- 1.00
- × continuity: actively changing
- 1.00
- × evidence: widely adopted
- 1.00
- Composite score
- 92.7
Best for: Exploring an unfamiliar GitHub repository before editing: it indexes code into symbols and returns signatures, summaries, and requested implementations instead of whole files.
It uses tree-sitter AST parsing to index a GitHub repository locally, then exposes seven tools for listing indexed repos, getting file trees and outlines, searching symbols, and fetching one or more symbol sources. The query tools only work on repositories that have first been indexed with index_repo.
GitHub stars2,634Stars / 30 days+142npm / typical weekShips no npm packageTools exposed7Last committodayCommits / 12 weeks725Maintenance gradeATool descriptionsAScore 80.8: show every number behind it
- Adoption86 / 100 · weight 40%
- GitHub stars86
- npm downloadsnot measuredno npm package
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance100 / 100 · weight 24%
- Last commit touching this server100
- Repository maintenance grade100
- Commit cadence100
- Momentum91 / 100 · weight 14%
- Stars gained, relative to size94
- Stars gained, absolute87
- npm download trendnot measuredno npm download history
- Tool quality76 / 100 · weight 13%
- Tool description quality68
- Built and inspected by Glama100
- Trust0 / 100 · weight 9%
- License0
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 80.8
- × relevance: the keyword is dedicated here
- 1.00
- × continuity: actively changing
- 1.00
- × evidence: widely adopted
- 1.00
- Composite score
- 80.8
Best for: Code archaeology across local and GitHub repositories: it combines local ripgrep/LSP navigation with GitHub PR search and npm package lookup.
It exposes 13 tools spanning GitHub code search and file reads, local ripgrep and filesystem tools, LSP navigation, and npm/PyPI package lookup. It runs via npx and requires Node.js 20.12+, with GitHub auth optional unless private repositories or higher rate limits are needed.
GitHub stars920Stars / 30 days+23npm / typical week3.1KTools exposed13Last commit5 days agoCommits / 12 weeks24Maintenance gradeATool descriptionsAScore 66.8: show every number behind it
- Adoption85 / 100 · weight 40%
- GitHub stars74
- npm downloads74
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance97 / 100 · weight 24%
- Last commit touching this server100
- Repository maintenance grade100
- Commit cadence85
- Momentum44 / 100 · weight 14%
- Stars gained, relative to size61
- Stars gained, absolute56
- npm download trend0
- Tool quality100 / 100 · weight 13%
- Tool description quality93
- Built and inspected by Glama100
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 85.6
- × relevance: the keyword is declared here
- 0.78
- × continuity: actively changing
- 1.00
- × evidence: widely adopted
- 1.00
- Composite score
- 66.8
Best for: Before starting a new project to check if it already exists: idea_check scans GitHub, npm, PyPI, Hacker News, and Stack Overflow for competitors.
It exposes one tool, idea_check, which takes an idea description and returns competitor evidence, trend direction, and pivot suggestions. That is the whole scope: no build, write, or additional MCP tools are present.
GitHub stars808Stars / 30 days+39npm / typical weekShips no npm packageTools exposed1Last commit19 days agoCommits / 12 weeks36Maintenance gradeBTool descriptionsAScore 65.3: show every number behind it
- Adoption73 / 100 · weight 40%
- GitHub stars73
- npm downloadsnot measuredno npm package
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance95 / 100 · weight 24%
- Last commit touching this server100
- Repository maintenance grade80
- Commit cadence100
- Momentum76 / 100 · weight 14%
- Stars gained, relative to size84
- Stars gained, absolute65
- npm download trendnot measuredno npm download history
- Tool quality93 / 100 · weight 13%
- Tool description quality85
- Built and inspected by Glama100
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 83.7
- × relevance: the keyword is declared here
- 0.78
- × continuity: actively changing
- 1.00
- × evidence: widely adopted
- 1.00
- Composite score
- 65.3
Best for: GitHub security audits spanning org settings, repos, Actions, secrets, supply chain, and access: it exposes 39 audit tools to AI agents.
The server exposes 39 MCP tools that check org settings, repository branch protection and secrets, Actions workflows, supply chain, and access control, and can run all checks and generate a Markdown audit report. Before choosing it, note that it expects a GITHUB_TOKEN with repo, admin:org, admin:org_hook, and admin:repo_hook scopes.
GitHub stars12Stars / 30 days+2npm / typical week298Tools exposed39Last commit169 days agoCommits / 12 weeks0Maintenance gradeDTool descriptionsAScore 59.6: show every number behind it
- Adoption57 / 100 · weight 40%
- GitHub stars28
- npm downloads53
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance46 / 100 · weight 24%
- Last commit touching this server68
- Repository maintenance grade30
- Commit cadence5
- Momentum50 / 100 · weight 14%
- Stars gained, relative to size44
- Stars gained, absolute18
- npm download trend100
- Tool quality76 / 100 · weight 13%
- Tool description quality68
- Built and inspected by Glama100
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 59.6
- × relevance: the keyword is dedicated here
- 1.00
- × continuity: actively changing
- 1.00
- × evidence: widely adopted
- 1.00
- Composite score
- 59.6
- 6
Best for: Debugging a cryptic error with an AI coding assistant: it returns StackOverflow, GitHub Issues, arXiv, and Wikipedia content as full conversations in a single call.
The README documents web_search(query, num_results=3), which returns top results with title, link, snippet, and page_content, and get_content(url), which returns page_content as Markdown. Before choosing it, note that it integrates with external search providers (Serper, SerpBase, Tavily, SearXNG, and Sofya) with intelligent fallback.
GitHub stars379Stars / 30 days+17npm / typical weekShips no npm packageTools exposednever inspectedLast committodayCommits / 12 weeks26Maintenance gradeBTool descriptionsNot gradedScore 58.3: show every number behind it
- Adoption64 / 100 · weight 40%
- GitHub stars64
- npm downloadsnot measuredno npm package
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance92 / 100 · weight 24%
- Last commit touching this server100
- Repository maintenance grade80
- Commit cadence85
- Momentum65 / 100 · weight 14%
- Stars gained, relative to size75
- Stars gained, absolute51
- npm download trendnot measuredno npm download history
- Tool quality≈68 / 100 · weight 13%
- Tool description quality≈68tool descriptions not yet scored
- Built and inspected by Glamanot measurednever built and inspected by Glama
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 74.7
- × relevance: the keyword is declared here
- 0.78
- × continuity: actively changing
- 1.00
- × evidence: widely adopted
- 1.00
- Composite score
- 58.3
Best for: For AI assistants needing accurate API usage from a niche GitHub library: it exposes the repo as a no-setup remote MCP endpoint.
GitMCP is a remote MCP server that connects AI assistants to a GitHub repository's docs and code through gitmcp.io/{owner}/{repo}, while its tool list spans Git operations, GitHub/Gitea repos, releases, backups, auth, config, and health checks. Before choosing, keep in mind that the generic gitmcp.io/docs mode leaves repository selection to the assistant, so the project recommends specific repository endpoints when security and relevance matter.
GitHub stars8,332Stars / 30 days+75npm / typical weekdownloads not countedTools exposed32Last commit114 days agoCommits / 12 weeks0Maintenance gradeFTool descriptionsCScore 58.3: show every number behind it
- Adoption98 / 100 · weight 40%
- GitHub stars98
- npm downloadsnot measurednpm names no repository for git-mcp, so its downloads cannot be attributed
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance51 / 100 · weight 24%
- Last commit touching this server88
- Repository maintenance grade5
- Commit cadence5
- Momentum53 / 100 · weight 14%
- Stars gained, relative to size38
- Stars gained, absolute76
- npm download trendnot measuredno npm download history
- Tool quality53 / 100 · weight 13%
- Tool description quality45
- Built and inspected by Glama100
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 74.7
- × relevance: the keyword is declared here
- 0.78
- × continuity: actively changing
- 1.00
- × evidence: widely adopted
- 1.00
- Composite score
- 58.3
Best for: For incident response and CVE triage in an AI chat: 41 tools across NVD, EPSS, KEV, GitHub Advisory, OSV, Shodan, and exploit sources.
The server exposes 41 tools that query vulnerability intelligence from NVD, EPSS, CISA KEV, GitHub Advisory, OSV, Shodan, VulnCheck, Vulners, Nuclei, Metasploit, CIRCL, and AttackerKB. It is distributed as an npm package and requires the Bun runtime.
GitHub stars19Stars / 30 days+6npm / typical week385Tools exposed41Last commit55 days agoCommits / 12 weeks5Maintenance gradeATool descriptionsAScore 57.0: show every number behind it
- Adoption60 / 100 · weight 40%
- GitHub stars33
- npm downloads55
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance86 / 100 · weight 24%
- Last commit touching this server88dated from the last commit on the default branch, re-read from GitHub at publication; github.com shows a push 18 days ago, which counts every ref; the stored date would have published 18 days ago
- Repository maintenance grade100
- Commit cadence65
- Momentum69 / 100 · weight 14%
- Stars gained, relative to size75
- Stars gained, absolute33
- npm download trend100
- Tool quality76 / 100 · weight 13%
- Tool description quality68
- Built and inspected by Glama100
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 73.1
- × relevance: the keyword is declared here
- 0.78
- × continuity: actively changing
- 1.00
- × evidence: widely adopted
- 1.00
- Composite score
- 57.0
Best for: For Claude Code, turning docs, repos, PDFs, videos, and code into AI skills and RAG knowledge: it exposes scrape, package, upload, and vector export tools.
The server exposes 40 tools that scrape documentation sites, GitHub repos, PDFs, videos, and codebases, then package, enhance, upload, and export the results to vector databases. Its install workflow treats AI enhancement as mandatory, requiring either an AI coding agent locally or a platform API key.
GitHub stars14,864Stars / 30 days+188npm / typical weekShips no npm packageTools exposed40Last commit21 days agoCommits / 12 weeks50Maintenance gradeATool descriptionsBScore 54.3: show every number behind it
- Adoption100 / 100 · weight 40%
- GitHub stars100
- npm downloadsnot measuredno npm package
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance100 / 100 · weight 24%
- Last commit touching this server100
- Repository maintenance grade100
- Commit cadence100
- Momentum64 / 100 · weight 14%
- Stars gained, relative to size46
- Stars gained, absolute92
- npm download trendnot measuredno npm download history
- Tool quality66 / 100 · weight 13%
- Tool description quality57
- Built and inspected by Glama100
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 90.5
- × relevance: the keyword is tagged here
- 0.60
- × continuity: actively changing
- 1.00
- × evidence: widely adopted
- 1.00
- Composite score
- 54.3
- 10
Best for: Teams planning GitHub Projects V2 sprints and milestones: it exposes create, update, and metrics tools for projects, milestones, sprints, issues, and pull requests.
The server exposes 84 tools for GitHub project management, covering create, list, update, delete, and metrics operations for projects, milestones, sprints, issues, and pull requests. It requires GITHUB_TOKEN, GITHUB_OWNER, and GITHUB_REPO environment variables to run.
GitHub stars95Stars / 30 days+1npm / typical week42Tools exposed84Last commit20 days agoCommits / 12 weeks63Maintenance gradeCTool descriptionsCScore 52.8: show every number behind it
- Adoption55 / 100 · weight 40%
- GitHub stars50
- npm downloads35
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance89 / 100 · weight 24%
- Last commit touching this server100
- Repository maintenance grade55
- Commit cadence100
- Momentum24 / 100 · weight 14%
- Stars gained, relative to size31
- Stars gained, absolute16
- npm download trend20
- Tool quality51 / 100 · weight 13%
- Tool description quality43
- Built and inspected by Glama100
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 62.1
- × relevance: the keyword is dedicated here
- 1.00
- × continuity: actively changing
- 1.00
- × evidence: modest but real audience
- 0.85
- Composite score
- 52.8
Best for: Developers wanting natural-language search over their own GitHub starred repositories: it indexes the stars and READMEs and exposes a query tool for them.
The README documents an MCP server deployed as a Cloudflare Worker, whose search_github_stars tool takes a natural-language query and returns matching starred repositories and relevant README content. Its setup assumes a Cloudflare account with R2 and AutoRAG configured, plus a GitHub Personal Access Token with repo scope.
GitHub stars112Stars / 30 days-1npm / typical weekdownloads not countedTools exposednever inspectedLast commityesterdayCommits / 12 weeks15Maintenance gradeBTool descriptionsNot gradedScore 51.3: show every number behind it
- Adoption51 / 100 · weight 40%
- GitHub stars51
- npm downloadsnot measurednpm names no repository for mcp-github-stars, so its downloads cannot be attributed
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance92 / 100 · weight 24%
- Last commit touching this server100
- Repository maintenance grade80
- Commit cadence85
- Momentum0 / 100 · weight 14%
- Stars gained, relative to size0
- Stars gained, absolute0
- npm download trendnot measuredno npm download history
- Tool quality≈68 / 100 · weight 13%
- Tool description quality≈68tool descriptions not yet scored
- Built and inspected by Glamanot measurednever built and inspected by Glama
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 60.4
- × relevance: the keyword is dedicated here
- 1.00
- × continuity: actively changing
- 1.00
- × evidence: modest but real audience
- 0.85
- Composite score
- 51.3
Best for: Building a product from a spec: its quickstart turns a PRD or one-line idea into a build with cost and time estimates before spending.
Loki Mode is an autonomous coding-agent CLI whose MCP server exposes project state and task queue operations, memory retrieve/store, code search, quality and verification reports, repo hotspots and co-changes, and structured findings and learnings over stdio. One requirement to know before choosing it is that non-interactive quickstart needs both an idea or PRD path and an explicit --yes, so a stray CI argument cannot start a paid build on its own.
GitHub stars1,050Stars / 30 days+25npm / typical week3.1KTools exposednever inspectedLast committodayCommits / 12 weeks1,168Maintenance gradeATool descriptionsNot gradedScore 49.5: show every number behind it
- Adoption87 / 100 · weight 40%
- GitHub stars76
- npm downloads74
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance100 / 100 · weight 24%
- Last commit touching this server100
- Repository maintenance grade100
- Commit cadence100
- Momentum44 / 100 · weight 14%
- Stars gained, relative to size59
- Stars gained, absolute57
- npm download trend0
- Tool quality≈68 / 100 · weight 13%
- Tool description quality≈68tool descriptions not yet scored
- Built and inspected by Glamanot measurednever built and inspected by Glama
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 82.5
- × relevance: the keyword is tagged here
- 0.60
- × continuity: actively changing
- 1.00
- × evidence: widely adopted
- 1.00
- Composite score
- 49.5
Best for: Wrapping an existing MCP server in a security boundary: it proxies MCP traffic and scans bidirectionally for credential leaks, prompt injection, and tool description poisoning.
Pipelock is a security proxy that wraps any MCP server and scans bidirectionally for credential leaks, prompt injection, and tool description poisoning; the README also documents inspection of HTTP, WebSocket, A2A, and CONNECT traffic. The server has not been inspected, so its tool list is unknown.
GitHub stars822Stars / 30 days+41npm / typical weekShips no npm packageTools exposednever inspectedLast committodayCommits / 12 weeks668Maintenance gradeATool descriptionsNot gradedScore 49.0: show every number behind it
- Adoption73 / 100 · weight 40%
- GitHub stars73
- npm downloadsnot measuredno npm package
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance100 / 100 · weight 24%
- Last commit touching this server100
- Repository maintenance grade100
- Commit cadence100
- Momentum77 / 100 · weight 14%
- Stars gained, relative to size85
- Stars gained, absolute65
- npm download trendnot measuredno npm download history
- Tool quality≈68 / 100 · weight 13%
- Tool description quality≈68tool descriptions not yet scored
- Built and inspected by Glamanot measurednever built and inspected by Glama
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 81.7
- × relevance: the keyword is tagged here
- 0.60
- × continuity: actively changing
- 1.00
- × evidence: widely adopted
- 1.00
- Composite score
- 49.0
Best for: Knowledge workers keeping personal notes and reusable prompts in Gists who want an AI client to edit them: it exposes gist, file, and comment tools.
This MCP server manages GitHub Gists behind a set of gist, file, and comment tools, and also exposes gists as resources under the gist:/// URI scheme. Outside VS Code, it requires a GitHub personal access token with only the gist scope.
GitHub stars202Stars / 30 days+2npm / typical week126Tools exposednever inspectedLast commit226 days agoCommits / 12 weeks0Maintenance gradeDTool descriptionsNot gradedScore 46.3: show every number behind it
- Adoption61 / 100 · weight 40%
- GitHub stars58
- npm downloads22downloads show none of the weekday rhythm human traffic has; halved
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance46 / 100 · weight 24%
- Last commit touching this server68
- Repository maintenance grade30
- Commit cadence5
- Momentum44 / 100 · weight 14%
- Stars gained, relative to size30
- Stars gained, absolute19
- npm download trend100
- Tool quality≈68 / 100 · weight 13%
- Tool description quality≈68tool descriptions not yet scored
- Built and inspected by Glamanot measurednever built and inspected by Glama
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 59.4
- × relevance: the keyword is declared here
- 0.78
- × continuity: actively changing
- 1.00
- × evidence: widely adopted
- 1.00
- Composite score
- 46.3
- 15
Best for: Claude Code users who want to activate and edit AI personas and skills: it exposes five tools covering create, read, update, delete, and execute.
It exposes five tools that provide create, read, update, delete, and execute operations for elements including personas, skills, templates, agents, memories, and ensembles. One thing to know before choosing it is that its elements live in a local portfolio folder and setup is run through npx.
GitHub stars41Stars / 30 days+4npm / typical week256Tools exposed5Last commit4 days agoCommits / 12 weeks173Maintenance gradeBTool descriptionsAScore 45.8: show every number behind it
- Adoption44 / 100 · weight 40%
- GitHub stars41
- npm downloads26downloads show none of the weekday rhythm human traffic has; halved
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance95 / 100 · weight 24%
- Last commit touching this server100
- Repository maintenance grade80
- Commit cadence100
- Momentum53 / 100 · weight 14%
- Stars gained, relative to size56
- Stars gained, absolute27
- npm download trend79
- Tool quality93 / 100 · weight 13%
- Tool description quality85
- Built and inspected by Glama100
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 69.1
- × relevance: the keyword is declared here
- 0.78
- × continuity: actively changing
- 1.00
- × evidence: modest but real audience
- 0.85
- Composite score
- 45.8
- 16
Best for: Local Git repo management from an AI assistant in VS Code: it integrates with VS Code and covers basic and advanced Git workflows.
The README documents an MCP server that wraps local Git commands, including add, commit, push, branch, stash, reset, clone, remote, merge, rebase, and cherry-pick, and also ships a CLI wrapper. Before choosing it, note that it runs Git operations in a local repository, so it needs a local Git repository to act on.
GitHub stars10Stars / 30 days0npm / typical week105Tools exposednever inspectedLast commit158 days agoCommits / 12 weeks0Maintenance gradeBTool descriptionsNot gradedScore 45.6: show every number behind it
- Adoption47 / 100 · weight 40%
- GitHub stars26
- npm downloads43
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance58 / 100 · weight 24%
- Last commit touching this server68
- Repository maintenance grade80
- Commit cadence5
- Momentum21 / 100 · weight 14%
- Stars gained, relative to size0
- Stars gained, absolute0
- npm download trend86
- Tool quality≈68 / 100 · weight 13%
- Tool description quality≈68tool descriptions not yet scored
- Built and inspected by Glamanot measurednever built and inspected by Glama
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 53.6
- × relevance: the keyword is dedicated here
- 1.00
- × continuity: actively changing
- 1.00
- × evidence: modest but real audience
- 0.85
- Composite score
- 45.6
Best for: A developer who needs GitHub API access through an MCP client: it enables file operations, repository management, and search functionality.
This server lets MCP clients use the GitHub API for file operations, repository management, and search functionality. Its exposed tools were not measured, so its tool list is unknown.
GitHub stars89,9776,427 after dividing by the 14 servers in this repositoryStars / 30 days+847npm / typical weekdownloads not countedTools exposednever inspectedLast commit404 days agoCommits / 12 weeks60Maintenance gradeATool descriptionsNot gradedScore 45.5: show every number behind it
- Adoption95 / 100 · weight 40%
- GitHub stars95
- npm downloadsnot measurednpm names no repository for @modelcontextprotocol/server-github, so its downloads cannot be attributed
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance42 / 100 · weight 24%
- Last commit touching this server42dated from the last commit on the default branch, re-read from GitHub at publication; github.com shows a push 0 days ago, which counts every ref
- Repository maintenance gradenot measuredrepository is active but this server inside it is not
- Commit cadencenot measuredrepository is active but this server inside it is not
- Momentum64 / 100 · weight 14%
- Stars gained, relative to size40
- Stars gained, absolute100
- npm download trendnot measuredno npm download history
- Tool quality≈76 / 100 · weight 13%
- Tool description quality≈68tool descriptions not yet scored
- Built and inspected by Glama100
- Trust≈100 / 100 · weight 9%
- License≈100no license detected
- Published by the vendor it integrates100
- Weighted mean of the five
- 75.8
- × relevance: the keyword is dedicated here
- 1.00
- × continuity: no change in over a year
- 0.60
- × evidence: widely adopted
- 1.00
- Composite score
- 45.5
- 18
Best for: Organizations that want to summarize discussions, issues, and pull requests beyond GitHub's 100-item API limit: it stores data locally and returns Markdown.
The README documents an interactive TUI for OAuth or personal-access-token setup, a pull command that populates a local database, and an MCP server that serves summaries from that database. It requires an ORGANIZATION value and a GitHub token, and only data that has been pulled is available to summarize.
GitHub stars78Stars / 30 days0npm / typical week14Tools exposednever inspectedLast commit207 days agoCommits / 12 weeks0Maintenance gradeCTool descriptionsNot gradedScore 45.3: show every number behind it
- Adoption51 / 100 · weight 40%
- GitHub stars47
- npm downloads25
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance52 / 100 · weight 24%
- Last commit touching this server68
- Repository maintenance grade55
- Commit cadence5
- Momentum18 / 100 · weight 14%
- Stars gained, relative to size0
- Stars gained, absolute0
- npm download trend72
- Tool quality≈68 / 100 · weight 13%
- Tool description quality≈68tool descriptions not yet scored
- Built and inspected by Glamanot measurednever built and inspected by Glama
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 53.3
- × relevance: the keyword is dedicated here
- 1.00
- × continuity: actively changing
- 1.00
- × evidence: modest but real audience
- 0.85
- Composite score
- 45.3
Best for: For AI coding agents fixing static-analysis findings in context: it exposes security, dead-code, secrets, quality, and remediation tools with file paths and line numbers.
The server exposes 12 tools that let an agent scan a repository and act on findings, including analyze, security_scan, quality_check, secrets_scan, verify_dead_code, remediate, generate_fix, validate_code_change, and get_security_context. One requirement to know before choosing it: Skylos is a local-first Python CLI, and its deterministic local API proof is reported as incomplete for PHP, Rust, Dart, C#, Kotlin, and Shell.
GitHub stars544Stars / 30 days+37npm / typical weekShips no npm packageTools exposed12Last commit5 days agoCommits / 12 weeks157Maintenance gradeATool descriptionsDScore 45.0: show every number behind it
- Adoption68 / 100 · weight 40%
- GitHub stars68
- npm downloadsnot measuredno npm package
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance100 / 100 · weight 24%
- Last commit touching this server100
- Repository maintenance grade100
- Commit cadence100
- Momentum83 / 100 · weight 14%
- Stars gained, relative to size96
- Stars gained, absolute64
- npm download trendnot measuredno npm download history
- Tool quality23 / 100 · weight 13%
- Tool description quality15
- Built and inspected by Glama100
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integratesnot measurednot published by the vendor it integrates
- Weighted mean of the five
- 75.0
- × relevance: the keyword is tagged here
- 0.60
- × continuity: actively changing
- 1.00
- × evidence: widely adopted
- 1.00
- Composite score
- 45.0
Best for: AI agent about to install a dependency: it checks exact or latest versions against OSV and GitHub Advisory DB, returning block, review, or allow.
It runs locally as an MCP server and CLI, and it checks package versions against public registry, OSV, and GitHub Advisory Database APIs. Provider coverage varies by ecosystem; if no vulnerability provider supports an ecosystem, results return unknown rather than allow.
GitHub stars61Stars / 30 days+1npm / typical week70Tools exposednever inspectedLast commit11 days agoCommits / 12 weeks73Maintenance gradeATool descriptionsNot gradedScore 44.7: show every number behind it
- Adoption51 / 100 · weight 40%
- GitHub stars45
- npm downloads39
- Used through Glamanot measurednot used through Glama in the last 30 days
- Maintenance100 / 100 · weight 24%
- Last commit touching this server100
- Repository maintenance grade100
- Commit cadence100
- Momentum39 / 100 · weight 14%
- Stars gained, relative to size31
- Stars gained, absolute14
- npm download trend81
- Tool quality≈68 / 100 · weight 13%
- Tool description quality≈68tool descriptions not yet scored
- Built and inspected by Glamanot measurednever built and inspected by Glama
- Trust100 / 100 · weight 9%
- License100
- Published by the vendor it integrates100
- Weighted mean of the five
- 67.4
- × relevance: the keyword is declared here
- 0.78
- × continuity: actively changing
- 1.00
- × evidence: modest but real audience
- 0.85
- Composite score
- 44.7
Questions people ask
Should I use GitHub MCP Server (github/github-mcp-server) or modelcontextprotocol/servers?
Use github/github-mcp-server if you want the official server and a remote server hosted by GitHub. It had a commit 3 days ago and 201 commits on its default branch in the last 12 weeks. modelcontextprotocol/servers is labelled Abandoned but popular, with a last commit on its default branch 404 days ago and 89,977 stars.
What do I need to run the official GitHub MCP Server?
Its README documents one-click install and OAuth/PAT configuration for teams using VS Code. It is a remote MCP server hosted by GitHub, and it has no npm package published, so you set it up through GitHub rather than installing a package.
How is github-codemunch-mcp different from GitHub MCP Server?
github-codemunch-mcp is for exploring an unfamiliar repository before editing, returning signatures, summaries, and requested implementations instead of whole files. It exposes 7 tools and had 725 commits in the last 12 weeks, with a commit 0 days ago. The official server is a remote server hosted by GitHub that documents one-click install and OAuth/PAT configuration.
Is github-security-mcp safe to rely on?
It is labelled Abandoned but popular: its last commit was 169 days ago, it had 0 commits on its default branch in the last 12 weeks, and the repository is not archived. It still exposes 39 audit tools with A-grade tool descriptions. That makes it a candidate for security audits, but not an actively developed one.
Should I use cve-mcp or deptrust for vulnerabilities?
Before installing a dependency, deptrust is the match, because it checks exact or latest versions against OSV and GitHub Advisory DB and returns block, review, or allow. For incident response and CVE triage in a chat, cve-mcp is the match, because it unifies NVD, EPSS, CISA KEV, GitHub Advisory, and OSV and exposes 41 tools. deptrust had a commit 11 days ago, while cve-mcp had a commit 55 days ago.
Which server should I use for GitHub Projects V2 sprint planning?
Use mcp-github-project-manager, because it integrates with GitHub Projects V2 and exposes create, update, and metrics tools for projects, milestones, sprints, issues, and pull requests. It is labelled Steady, with a commit 20 days ago and 63 commits in the last 12 weeks.