What can you do with this server?

This server provides read and optional write access to GitHub repositories, issues, and pull requests via the GitHub REST API, with write operations disabled by default for safety. Read tools (always available, work unauthenticated): * get_repo – Fetch repository metadata: description, language, stars, forks, open issues, default branch, archived flag, license, last-push time. * list_issues – List issues (excluding PRs), sorted by most recently updated; filter by state and limit. * get_issue – Get full details of a single issue (title, body, state, labels, comment count). * list_pull_requests – List pull requests, sorted by most recently updated; filter by state and limit. * get_pull_request – Fetch full details of a single pull request, including merge state. * get_file_content – Read a UTF-8 text file from a repository at a given path (base64-decoded); binary files are reported but not decoded. * search_repos – Search public repositories by keyword/qualifiers, sorted by best match. * get_user – Retrieve public profile of a GitHub user or organization. * list_commits – List commits on a branch/ref, newest first. Write tools (disabled by default; require GITHUB_MCP_ENABLE_WRITE=1 and GITHUB_TOKEN): * create_issue – Open a new issue (title, optional body and labels). * comment_on_issue – Post a comment on an issue or pull request. * update_issue_state – Set an issue's state to open or closed. * add_labels – Add one or more labels to an issue or pull request. * create_pr_review_comment – Create a review comment on a specific line of a pull request’s diff. Safety & error handling: * Write tools are off by default; calling them without opt-in returns a structured policy_refusal error. Missing token returns auth_required. * Read operations work without authentication but are subject to lower rate limits (60 req/hr). Providing a fine-grained PAT boosts rate limits and is mandatory for writes. * Structured errors are returned for rate limiting, API errors (4xx/5xx), network issues, and malformed inputs—never crashing the server.

Which integrations are available for this server?

Provides tools for interacting with the GitHub REST API, enabling read and write operations on repositories, issues, pull requests, file contents, commits, and user profiles. Write tools are disabled by default for safety.

github-mcp

by jaimenbell

Overview Schema Related Servers Score Discussions

Python

Remote

This server provides read and optional write access to GitHub repositories, issues, and pull requests via the GitHub REST API, with write operations disabled by default for safety.

Read tools (always available, work unauthenticated):

get_repo – Fetch repository metadata: description, language, stars, forks, open issues, default branch, archived flag, license, last-push time.
list_issues – List issues (excluding PRs), sorted by most recently updated; filter by state and limit.
get_issue – Get full details of a single issue (title, body, state, labels, comment count).
list_pull_requests – List pull requests, sorted by most recently updated; filter by state and limit.
get_pull_request – Fetch full details of a single pull request, including merge state.
get_file_content – Read a UTF-8 text file from a repository at a given path (base64-decoded); binary files are reported but not decoded.
search_repos – Search public repositories by keyword/qualifiers, sorted by best match.
get_user – Retrieve public profile of a GitHub user or organization.
list_commits – List commits on a branch/ref, newest first.

Write tools (disabled by default; require GITHUB_MCP_ENABLE_WRITE=1 and GITHUB_TOKEN):

create_issue – Open a new issue (title, optional body and labels).
comment_on_issue – Post a comment on an issue or pull request.
update_issue_state – Set an issue's state to open or closed.
add_labels – Add one or more labels to an issue or pull request.
create_pr_review_comment – Create a review comment on a specific line of a pull request’s diff.

Safety & error handling:

Write tools are off by default; calling them without opt-in returns a structured policy_refusal error. Missing token returns auth_required.
Read operations work without authentication but are subject to lower rate limits (60 req/hr). Providing a fine-grained PAT boosts rate limits and is mandatory for writes.
Structured errors are returned for rate limiting, API errors (4xx/5xx), network issues, and malformed inputs—never crashing the server.

github-mcp

PyPI MCP Registry License: MIT tests

A public read+write MCP server over the GitHub REST API, built to the desktop-mcp/rag-mcp/mcp-factory standard (own pyproject, fastmcp server, honest README, real test suite) with env-gated tool groups (write disabled by default). Not the official GitHub MCP server -- see below.

Quickstart (60 seconds)

pip install jaimenbell-github-mcp

// Add to your MCP host config (e.g. Claude Desktop/Code's mcpServers block)
{
  "mcpServers": {
    "github-mcp": {
      "command": "github-mcp"
    }
  }
}

The write tool group (issue/PR mutations) is off by default -- see Env vars below to enable it.

Related MCP server: @cloud9-labs/mcp-github

What this is / is not

This is a reference portfolio implementation demonstrating a hardened read+write MCP server pattern over a real external SaaS API (GitHub) -- env-gated tool groups, typed error/rate-limit handling, auth that degrades gracefully, a real test suite. It exists to show, concretely, "I build read/write MCP servers over external APIs" with a link a client can click.

It is NOT the official GitHub MCP server. It does not aim for parity with GitHub's own MCP offering (GraphQL, Actions, webhooks, GitHub Apps are all out of scope -- see below). It started life as a factory-scaffolded read-only demo (mcp-factory's generated/github_read_server.py) and was hand-hardened into this standalone read+write server -- the scaffold-then-harden path is itself part of the story this repo tells.

Tools (14)

One row per tool -- the two groups below just control default-on/off state, not what exists.

Tool	Group	What it does
`get_repo`	`read`	Repo metadata (stars, language, license, default branch, archived flag...)
`list_issues`	`read`	List issues on a repo (PRs filtered out)
`get_issue`	`read`	Fetch a single issue
`list_pull_requests`	`read`	List pull requests on a repo
`get_pull_request`	`read`	Fetch a single pull request
`get_file_content`	`read`	Read a repo file's content (base64-decoded, binary detected not decoded)
`search_repos`	`read`	Search public repositories
`get_user`	`read`	Public user/org profile
`list_commits`	`read`	List commits on a branch/ref
`create_issue`	`write`	Open an issue
`comment_on_issue`	`write`	Comment on an issue/PR
`update_issue_state`	`write`	Open/close an issue
`add_labels`	`write`	Add labels to an issue/PR
`create_pr_review_comment`	`write`	Create a PR review comment on a diff line

read is always on and works unauthenticated (GitHub's 60 req/hr tier). write is env-gated and OFF by default -- requires GITHUB_MCP_ENABLE_WRITE=1 and GITHUB_TOKEN.

A disabled write call returns a structured policy_refusal error (never a silent no-op, never a crash). A write call with the group enabled but no token returns a structured auth_required error -- the group gate and the token precondition are checked independently, both before any network call.

Write-safety-off-by-default

This is defense-in-depth, mirroring desktop-mcp's input group: harness-level permission prompts are the first gate, but the server itself refuses every write tool unless its own environment explicitly opts in with GITHUB_MCP_ENABLE_WRITE=1, and even then refuses without a GITHUB_TOKEN. A misconfigured or overly-permissive MCP host cannot turn on GitHub mutations this process wasn't deliberately configured to allow. The registration this repo ships with (see ~/.claude.json's github-mcp entry) has the write group absent from env -- enabling it is a deliberate per-registration operator choice, not a code change.

Honest-capabilities table

Every claim below maps to the file that implements it and the test(s) that verify it -- no capability is asserted without a corresponding implementation and test.

Claim	Implementation	Verified by
Repo metadata (stars, language, license, default branch, archived flag...)	`github_mcp/groups/read.py::get_repo`	`tests/test_read.py::TestGetRepo`, live: `tests/test_live_smoke.py::test_live_get_repo_real_json`
List / fetch issues (PRs filtered from list)	`github_mcp/groups/read.py::list_issues`, `get_issue`	`tests/test_read.py::TestListIssues`, `TestGetIssue`
List / fetch pull requests	`github_mcp/groups/read.py::list_pull_requests`, `get_pull_request`	`tests/test_read.py::TestListPullRequests`, `TestGetPullRequest`
Read a repo file's content (base64-decoded, binary detected not decoded)	`github_mcp/groups/read.py::get_file_content`	`tests/test_read.py::TestGetFileContent`
Search public repositories	`github_mcp/groups/read.py::search_repos`	`tests/test_read.py::TestSearchRepos`
Public user/org profile	`github_mcp/groups/read.py::get_user`	`tests/test_read.py::TestGetUser`
List commits on a branch/ref	`github_mcp/groups/read.py::list_commits`	`tests/test_read.py::TestListCommits`
Open an issue	`github_mcp/groups/write.py::create_issue`	`tests/test_write.py::TestCreateIssue`
Comment on an issue/PR	`github_mcp/groups/write.py::comment_on_issue`	`tests/test_write.py::TestCommentOnIssue`
Open/close an issue	`github_mcp/groups/write.py::update_issue_state`	`tests/test_write.py::TestUpdateIssueState`
Add labels to an issue/PR	`github_mcp/groups/write.py::add_labels`	`tests/test_write.py::TestAddLabels`
Create a PR review comment on a diff line	`github_mcp/groups/write.py::create_pr_review_comment`	`tests/test_write.py::TestCreatePrReviewComment`
Write group OFF by default, structured refusal when disabled	`github_mcp/config.py::group_enabled`, `gated_write`	`tests/test_config.py::TestGroupEnabled`, `tests/test_write.py::TestGateDisabledByDefault`
Write tools require a token even when the group is enabled	`github_mcp/config.py::check_write_preconditions`	`tests/test_config.py::TestCheckWritePreconditions`, `tests/test_write.py::TestAuthRequiredWhenGroupEnabled`
Fine-grained PAT auth, degrades to unauthenticated tier when absent	`github_mcp/client.py::_headers`	`tests/test_client.py::TestAuthHeaderInjection`, `tests/test_read.py::TestUnauthDegrade`
GitHub primary rate-limit (403 + `X-RateLimit-Reset`) and secondary rate-limit (403 + `Retry-After`, no `X-RateLimit-Remaining`) both surface as a typed error with reset/retry time, never a crash	`github_mcp/client.py::_rate_limit_error`, `_is_rate_limit_response`	`tests/test_client.py::TestRateLimitError`, `tests/test_client.py::TestRateLimitError::test_secondary_rate_limit_no_ratelimit_headers_retry_after_only`, `tests/test_read.py::TestUnauthDegrade::test_get_repo_rate_limited_without_token_is_typed`
Malformed owner/repo/path (control chars etc.) that would raise `httpx.InvalidURL` surfaces as a typed error, never an uncaught exception	`github_mcp/client.py::request`	`tests/test_client.py::TestNetworkError::test_malformed_path_raises_invalid_url_caught_as_network_error`
Generic 4xx/5xx surfaces as a typed error, never a crash	`github_mcp/client.py::_api_error`	`tests/test_client.py::TestApiError`
Non-JSON / malformed responses and network failures surface as typed errors	`github_mcp/client.py::_handle_response`, `request`	`tests/test_client.py::TestDecodeError`, `TestNetworkError`

Limitations (read before relying on this)

REST v1 only. No GraphQL API coverage.
No webhooks / GitHub App auth. Fine-grained PAT only.
No Actions/workflow-dispatch tools. Issue/PR CRUD is the v1 write surface.
Unauthenticated read is rate-limited to 60 req/hr by GitHub itself (10 req/min for search) -- expect rate_limited errors under sustained unauthenticated use; set GITHUB_TOKEN (even a read-only fine-grained PAT) to raise this considerably.
get_file_content truncates past 100KB and reports (rather than decodes) non-UTF-8 files.
No pagination beyond a single page for list endpoints (limit, capped per-endpoint, is the only page-size control in v1).
Not registered with the mcp-factory hub. Ships as a standalone repo (own pyproject, system Python312 install), matching the rag-mcp/desktop-mcp model.

Env vars

Var	Effect	Default
`GITHUB_MCP_ENABLE_WRITE`	enable the `write` tool group	unset (off)
`GITHUB_TOKEN`	fine-grained PAT; read works without it (degraded unauth rate), write requires it	unset
`GITHUB_MCP_LIVE`	`1` to run the real-network smoke test (see Testing)	unset (skip)

Usage examples

// A tool call from the MCP host, illustrative -- not a shell command.
{"tool": "get_repo", "arguments": {"owner": "anthropics", "repo": "anthropic-sdk-python"}}
// -> {"ok": true, "full_name": "anthropics/anthropic-sdk-python", "stargazers_count": 1234, ...}

// write group disabled (default):
{"tool": "create_issue", "arguments": {"owner": "o", "repo": "r", "title": "bug"}}
// -> {"ok": false, "error": {"type": "policy_refusal", "group": "write", "required_env": "GITHUB_MCP_ENABLE_WRITE", ...}}

// write group enabled, no token set:
{"tool": "create_issue", "arguments": {"owner": "o", "repo": "r", "title": "bug"}}
// -> {"ok": false, "error": {"type": "auth_required", "tool": "create_issue", ...}}

Testing

CI (.github/workflows/ci.yml) runs this suite on every push/PR and fails the build if the Tests badge above drifts from what the suite actually reports -- see scripts/check_readme_counts.py.

# unit suite (respx-mocked api.github.com, no real network touched)
python -m pytest -q

# handshake check -- prints every registered tool name
python scripts/list_tools.py

# real-network read smoke (get_repo against a stable public repo;
# no write smoke exists anywhere in this suite -- see safety rails above)
GITHUB_MCP_LIVE=1 python -m pytest -q -k live_get_repo

Install

pip install -r requirements.txt   # or: pip install .
# deps: fastmcp==3.4.2, httpx==0.28.1
# test-only: pytest==9.0.3, respx==0.23.1

Setup / connect

pip install -r requirements.txt on Python 3.12+.
(Optional) generate a fine-grained PAT scoped to the repos you want read+write access to (Issues: read/write, Pull requests: read/write, Contents: read is enough for v1). Read tools work with no token at all -- they just run at GitHub's unauthenticated 60 req/hr tier.
Add to your MCP host config (e.g. ~/.claude.json):

{
  "mcpServers": {
    "github-mcp": {
      "command": "C:\\Users\\<you>\\AppData\\Local\\Programs\\Python\\Python312\\python.exe",
      "args": ["C:\\Users\\<you>\\projects\\github-mcp\\run_server.py"],
      "env": {
        "GITHUB_TOKEN": "your-fine-grained-pat-here"
        // GITHUB_MCP_ENABLE_WRITE intentionally absent -- write stays off
        // until you deliberately opt in per-deployment.
      }
    }
  }
}

To enable write tools for a given deployment, add "GITHUB_MCP_ENABLE_WRITE": "1" to that entry's env block. This is a registration-time operator decision, not a code change.

Registered in ~/.claude.json as github-mcp (stdio, system Python312, read group always on, write group absent from env -- off).

Commercial support

Maintained by Jaimen Bell. For production MCP integrations, custom servers, or agent-reliability work, see jaimenbell.dev.

Building your own MCP server? The MCP Starter Kit has templates, a build playbook, and packaging war-stories from shipping this one.

mcp-name: io.github.jaimenbell/github-mcp

Available Tools

2 tools

create_pr_review_commentB

Create a review comment on a specific line of a pull request's diff. Requires GITHUB_MCP_ENABLE_WRITE=1 and GITHUB_TOKEN.

ParametersJSON Schema

Name	Required	Description	Default
`body`	Yes
`line`	Yes
`path`	Yes
`repo`	Yes
`owner`	Yes
`commit_id`	Yes
`pr_number`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

B3/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so description carries full behavioral disclosure burden. It states it requires write permissions but doesn't disclose other traits such as whether the operation is mutable, idempotent, or any side effects (e.g., does it trigger notifications?). The description is insufficient for an agent to understand the tool's full behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (two sentences), front-loaded with the main action, and includes necessary prerequisite mention. No wasted words, though it could benefit from parameter context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 7 required parameters with no schema descriptions and no annotations, the description is far from complete. It does not cover return values (though output schema exists, unknown to agent), error cases, or additional context about the comment creation process. The agent would struggle to use this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for 7 required parameters. The description provides zero explanation of what each parameter means (e.g., 'line', 'commit_id', 'path'), leaving the agent to rely solely on parameter names. This is a critical gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states 'Create a review comment on a specific line of a pull request's diff', clearly identifying the action (create) and resource (review comment on PR diff line). It distinguishes from the sibling tool 'list_commits' which is read-only.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions required environment variables (GITHUB_MCP_ENABLE_WRITE=1 and GITHUB_TOKEN), providing a prerequisite. However, it offers no guidance on when to use this tool versus alternatives (only sibling is list_commits, which is clearly different) and no exclusions or when-not-to-use scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_commitsA

List commits on a repo's default branch (or a given ref), newest first.

ParametersJSON Schema

Name	Required	Description	Default
`sha`	No
`repo`	Yes
`limit`	No
`owner`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

A3.6/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided; description discloses basic behavior (listing commits, ordering, optional ref) but omits details like pagination (limit default of 20) and authentication requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, 14 words, front-loaded with the action. No unnecessary information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description adequately covers input semantics and basic behavior. Missing explicit mention of the default limit, but it is defined in the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%; description adds meaning for the 'sha' parameter as a ref, but does not explain 'limit', 'owner', or 'repo' beyond their names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the verb 'List' and resource 'commits', specifies the scope (default branch or given ref, newest first), and is distinct from the sibling tool create_pr_review_comment.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives, nor any conditions or exclusions. The description only implies listing commits.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

2 tool updatesv0.1.1Jul 27, 2026
- First observedcreate_pr_review_comment
- First observedlist_commits

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

B3.3/5.0

Disambiguation5/5

The two tools target entirely different actions: listing commits vs. creating PR review comments. No overlap exists, and an agent can clearly distinguish them.

Naming Consistency5/5

Both tools follow a consistent verb_noun pattern in snake_case (list_commits, create_pr_review_comment), showing good naming discipline.

Tool Count2/5

With only 2 tools, the server is severely under-scoped for a GitHub MCP server, which typically requires at least a dozen tools to cover basic operations like issues, PRs, and repos.

Completeness2/5

The tool surface has major gaps: no tools for issues, repositories, pull requests (beyond a review comment), or search. An agent would often fail to accomplish common GitHub tasks.

Maintenance

ActivityMaintained

ResponsivenessSyncing

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

Github A
io.github.pipeworx-io
GitHub MCP — wraps the GitHub public REST API (no auth required for public endpoints)
Version Control Developer Tools Project Management
402
QuillCaddie MCPOAuth
com.quillcaddie.www
OAuth-protected, read-only-by-default MCP server for provenance-labeled QuillCaddie project memory.
Knowledge & Memory Project Management
2
Arlet
dev.arlet
Create, deploy, and operate MCP servers directly from your GitHub repositories.
Developer Tools CI/CD & DevOps
2
Probe V0 A
io.github.lexbritten
Experimental MCP server for current empirical verification of explicit public HTTPS endpoint claims.
API Testing Penetration Testing
21

Related MCP Servers

mcp-github
Version Control Developer Tools
Livshitz
F
license
Not graded
quality
C
maintenance
MCP server for the GitHub REST API that enables interaction with repositories, pull requests, issues, branches, commits, reviews, and code search, with configurable write and destructive operations.
Updated 2 months ago (2026-07-01 17:43 UTC)
-
@cloud9-labs/mcp-github
Version Control Developer Tools
cloud9-labs
A
license
B
quality
D
maintenance
MCP (Model Context Protocol) server for GitHub API integration. This server provides comprehensive tools for interacting with GitHub repositories, issues, pull requests, branches, and code search through a unified interface.
Updated 7 months ago (2026-02-12 04:44 UTC)
15
14
MIT
GitHub Read MCP Server
Version Control Developer Tools
jaimenbell
F
license
Not graded
quality
C
maintenance
Read-only MCP server for the GitHub REST API that enables agents to query repositories, issues, files, and users without any write access.
Updated 2 months ago (2026-06-24 15:46 UTC)
-
MCP GitHub Server
Version Control CI/CD & DevOps
LeonidYasin
F
license
Not graded
quality
B
maintenance
HTTP MCP server for GitHub API with tools for file manipulation, commit listing, and workflow logs.
Updated 14 days ago (2026-08-22 22:55 UTC)
-

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/jaimenbell/github-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

github-mcp

Quickstart (60 seconds)

What this is / is not

Tools (14)

Write-safety-off-by-default

Honest-capabilities table

Limitations (read before relying on this)

Env vars

Usage examples

Testing

Install

Setup / connect

Commercial support

Available Tools

Output Schema

TDQS

Output Schema

TDQS

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

mcp-github

@cloud9-labs/mcp-github

GitHub Read MCP Server

MCP GitHub Server

Latest Blog Posts

MCP directory API