GitHub

GitHub's official hosted MCP server for repository context, issues, pull requests, code search, and development workflows.

Connection specification

Remote endpoint: https://api.githubcopilot.com/mcp/
Live-validated endpoint: https://api.githubcopilot.com/mcp
Browser access: Not yet measured
Declared MCP transport: Streamable HTTP
Live-validated MCP transport: Not yet verified — Latest validation did not verify a transport
Declared authentication: OAuth 2.1
Detected authentication: OAuth 2.1 detected or retained from publisher evidence
Alternative authentication: Bearer token
Protocol lifecycle: Not yet negotiated
Required header: Authorization — Optional GitHub personal access token: Bearer <GITHUB_PERSONAL_ACCESS_TOKEN>
Authorization server: https://github.com/login/oauth
Category: Developer Tools

Product documentation · Source repository · Official listing documentation

Provider guidance

Browser OAuth requires the mcptest operator's GITHUB_OAUTH_CLIENT_ID and GITHUB_OAUTH_CLIENT_SECRET Worker bindings. Production readiness must not be claimed until both are configured; a GitHub personal access token remains an alternative.

Browse all MCP servers · Test this endpoint in the MCP Playground

Authorization setup

mcptest operator setup required

This provider requires a confidential application managed by the mcptest operator. Its client secret and token exchange stay server-side and must never be pasted into a browser.

Publisher evidence reviewed 2026-08-24.

Client ID: Required
Client secret: Required — never enter it in a browser
Browser/public client: Not supported

Required non-secret settings

Application owner: mcptest operator (required)
Callback: Hosted mcptest callback (required)

Callback URIs

https://mcptest.io/oauth/callback

Provider setup steps

The mcptest operator creates and owns the GitHub OAuth or GitHub App.
Register the exact hosted mcptest callback URI.
Configure the client ID and client secret only in operator-controlled server bindings.
Retry hosted authorization after operator configuration is confirmed.

Safe header template: Bearer <GITHUB_PERSONAL_ACCESS_TOKEN>. Replace only the named placeholder in protected client configuration.

Open provider setup or application page

Publisher documentation

Connect this server to your client

Claude Code setup

Run in a terminal. This user-scoped entry is available across projects.

claude mcp add --transport http --scope user --header 'Authorization: Bearer '"${GITHUB_PERSONAL_ACCESS_TOKEN}" 'github' 'https://api.githubcopilot.com/mcp'

mcptest operator setup required: This provider requires a confidential application managed by the mcptest operator. Its client secret and token exchange stay server-side and must never be pasted into a browser.

Using live-validated endpoint: https://api.githubcopilot.com/mcp
mcptest operator setup required: This provider requires a confidential application managed by the mcptest operator. Its client secret and token exchange stay server-side and must never be pasted into a browser.
Provider setup: The mcptest operator creates and owns the GitHub OAuth or GitHub App.
Provider setup: Register the exact hosted mcptest callback URI.
Provider setup: Configure the client ID and client secret only in operator-controlled server bindings.
Provider setup: Retry hosted authorization after operator configuration is confirmed.
Publisher evidence (reviewed 2026-08-24): https://github.com/github/github-mcp-server/blob/main/docs/remote-server.md
Provider guidance: Browser OAuth requires the mcptest operator's GITHUB_OAUTH_CLIENT_ID and GITHUB_OAUTH_CLIENT_SECRET Worker bindings. Production readiness must not be claimed until both are configured; a GitHub personal access token remains an alternative.
Store GITHUB_PERSONAL_ACCESS_TOKEN in your operating system keychain, secret manager, or protected environment; never commit the value. The Authorization header syntax is Bearer <GITHUB_PERSONAL_ACCESS_TOKEN>.

Claude Code MCP documentation

Codex CLI setup

Run in a terminal; Codex stores the entry in ~/.codex/config.toml.

codex mcp add 'github' --url 'https://api.githubcopilot.com/mcp' --bearer-token-env-var 'GITHUB_PERSONAL_ACCESS_TOKEN'

Using live-validated endpoint: https://api.githubcopilot.com/mcp
mcptest operator setup required: This provider requires a confidential application managed by the mcptest operator. Its client secret and token exchange stay server-side and must never be pasted into a browser.
Provider setup: The mcptest operator creates and owns the GitHub OAuth or GitHub App.
Provider setup: Register the exact hosted mcptest callback URI.
Provider setup: Configure the client ID and client secret only in operator-controlled server bindings.
Provider setup: Retry hosted authorization after operator configuration is confirmed.
Publisher evidence (reviewed 2026-08-24): https://github.com/github/github-mcp-server/blob/main/docs/remote-server.md
Provider guidance: Browser OAuth requires the mcptest operator's GITHUB_OAUTH_CLIENT_ID and GITHUB_OAUTH_CLIENT_SECRET Worker bindings. Production readiness must not be claimed until both are configured; a GitHub personal access token remains an alternative.
Store GITHUB_PERSONAL_ACCESS_TOKEN in your operating system keychain, secret manager, or protected environment; never commit the value. The Authorization header syntax is Bearer <GITHUB_PERSONAL_ACCESS_TOKEN>.

Codex MCP documentation

Cursor setup

Add to .cursor/mcp.json for this project, or ~/.cursor/mcp.json for all projects.

{
  "mcpServers": {
    "github": {
      "url": "https://api.githubcopilot.com/mcp",
      "headers": {
        "Authorization": "Bearer ${env:GITHUB_PERSONAL_ACCESS_TOKEN}"
      }
    }
  }
}

Using live-validated endpoint: https://api.githubcopilot.com/mcp
mcptest operator setup required: This provider requires a confidential application managed by the mcptest operator. Its client secret and token exchange stay server-side and must never be pasted into a browser.
Provider setup: The mcptest operator creates and owns the GitHub OAuth or GitHub App.
Provider setup: Register the exact hosted mcptest callback URI.
Provider setup: Configure the client ID and client secret only in operator-controlled server bindings.
Provider setup: Retry hosted authorization after operator configuration is confirmed.
Publisher evidence (reviewed 2026-08-24): https://github.com/github/github-mcp-server/blob/main/docs/remote-server.md
Provider guidance: Browser OAuth requires the mcptest operator's GITHUB_OAUTH_CLIENT_ID and GITHUB_OAUTH_CLIENT_SECRET Worker bindings. Production readiness must not be claimed until both are configured; a GitHub personal access token remains an alternative.
Store GITHUB_PERSONAL_ACCESS_TOKEN in your operating system keychain, secret manager, or protected environment; never commit the value. The Authorization header syntax is Bearer <GITHUB_PERSONAL_ACCESS_TOKEN>.

Cursor MCP documentation

VS Code setup

Add to .vscode/mcp.json, or run “MCP: Open User Configuration” for a private user-level entry.

{
  "servers": {
    "github": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp",
      "headers": {
        "Authorization": "Bearer ${input:github_personal_access_token}"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "github_personal_access_token",
      "description": "GITHUB_PERSONAL_ACCESS_TOKEN for GitHub",
      "password": true
    }
  ]
}

Using live-validated endpoint: https://api.githubcopilot.com/mcp
mcptest operator setup required: This provider requires a confidential application managed by the mcptest operator. Its client secret and token exchange stay server-side and must never be pasted into a browser.
Provider setup: The mcptest operator creates and owns the GitHub OAuth or GitHub App.
Provider setup: Register the exact hosted mcptest callback URI.
Provider setup: Configure the client ID and client secret only in operator-controlled server bindings.
Provider setup: Retry hosted authorization after operator configuration is confirmed.
Publisher evidence (reviewed 2026-08-24): https://github.com/github/github-mcp-server/blob/main/docs/remote-server.md
Provider guidance: Browser OAuth requires the mcptest operator's GITHUB_OAUTH_CLIENT_ID and GITHUB_OAUTH_CLIENT_SECRET Worker bindings. Production readiness must not be claimed until both are configured; a GitHub personal access token remains an alternative.
VS Code requests GITHUB_PERSONAL_ACCESS_TOKEN as a masked input; use a secret manager and do not put a default value in mcp.json. The Authorization syntax remains Bearer <GITHUB_PERSONAL_ACCESS_TOKEN>.

VS Code MCP documentation

Latest validation evidence

Validation status: Online when last tested
Validation checked at: Aug 18, 2026 at 1:34 PM
Validation detail: Authentication challenge at https://api.githubcopilot.com/mcp returned HTTP 401; endpoint was reachable but did not complete an MCP probe; authentication oauth