GitHub MCP Server 🔌 MCP server Free

What it does

GitHub MCP Server is GitHub's own bridge between coding agents and the GitHub platform. Once connected, an agent can read repositories and files, search code, open and update issues and pull requests, look at GitHub Actions runs to work out why a build failed, and review code scanning, secret scanning and Dependabot findings. It is written in Go and released under the MIT licence. You can use the copy GitHub hosts or run it yourself as a Docker container or a standalone binary.

Tools it gives your agent

Tools are grouped into toolsets, so you can switch on only the parts you need:

• context, repos, issues, pull_requests and users, which are the defaults
• actions, for workflows, runs, jobs and logs
• code_security, secret_protection, dependabot and security_advisories
• discussions, gists, labels, notifications, orgs, projects and git
• On the hosted server only: Copilot coding agent tools, Copilot Spaces and GitHub support docs search

Works with

The hosted server lives at api.githubcopilot.com/mcp/ and works with any client that supports remote MCP servers over HTTP. The README has setup guides for VS Code, Claude Desktop, Claude Code, Codex, Copilot CLI, Cursor, Windsurf, Zed, OpenCode and several JetBrains and other IDEs. If your client only supports local servers, run the Docker image ghcr.io/github/github-mcp-server instead. GitHub Enterprise Server users also need the local version, because GitHub does not host the server for them.

How to connect

Claude Code, hosted server with a personal access token:

claude mcp add --transport http github https://api.githubcopilot.com/mcp -H "Authorization: Bearer YOUR_GITHUB_PAT"

Claude Code, local server in Docker:

claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=YOUR_GITHUB_PAT -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server

Cost and limits

The server is free. You only need a GitHub account, and every call counts toward that account's normal GitHub API rate limits.

Safety notes

The agent can do anything your token allows, so use a fine-grained token that covers only the repositories and permissions you need. The --read-only flag removes every write tool. --lockdown-mode hides public-repo content from authors without push access, which lowers the risk of prompt injection. The README says clearly that it is a filter, not a permission boundary. OAuth sign-in is also available, and local OAuth tokens are held only in memory.