GitHub MCP server

Endpoint: https://api.githubcopilot.com/mcp/ · Authentication: Sign in with OAuth

GitHub's official hosted MCP server for repository context, issues, pull requests, code search, and development workflows.

Test it live Run the release-readiness report

How do I authenticate?

Add the endpoint in your client, start Connect or Sign in, approve the requested scopes, and return to the client. OAuth discovery finds the authorization server; client registration requirements vary by provider. Follow the provider guidance and client setup below.

Authentication and connection guide

Connection specification

Remote endpoint: https://api.githubcopilot.com/mcp/
Live-validated endpoint: https://api.githubcopilot.com/mcp
Browser access: Not yet measured
Declared MCP transport: Streamable HTTP
Live-validated MCP transport: Not yet verified — Latest validation did not verify a transport
Declared authentication: OAuth 2.1
Detected authentication: OAuth 2.1 detected or retained from publisher evidence
Alternative authentication: Bearer token
Protocol lifecycle: Not yet negotiated
Required header: Authorization — Optional GitHub personal access token: Bearer <GITHUB_PERSONAL_ACCESS_TOKEN>
Authorization server: https://github.com/login/oauth
Category: Developer Tools

Product documentation · Source repository · Official listing documentation

Provider guidance

Browser OAuth requires the mcptest operator's GITHUB_OAUTH_CLIENT_ID and GITHUB_OAUTH_CLIENT_SECRET Worker bindings. Production readiness must not be claimed until both are configured; a GitHub personal access token remains an alternative.

More Developer Tools MCP servers · Browse all MCP servers · Test this endpoint in the MCP Playground

Authorization setup

mcptest operator setup required

This provider requires a confidential application managed by the mcptest operator. Its client secret and token exchange stay server-side and must never be pasted into a browser.

Publisher evidence reviewed 2026-08-24.

Client ID: Required
Client secret: Required — never enter it in a browser
Browser/public client: Not supported

Required non-secret settings

Application owner: mcptest operator (required)
Callback: Hosted mcptest callback (required)

Callback URIs

https://mcptest.io/oauth/callback

Provider setup steps

The mcptest operator creates and owns the GitHub OAuth or GitHub App.
Register the exact hosted mcptest callback URI.
Configure the client ID and client secret only in operator-controlled server bindings.
Retry hosted authorization after operator configuration is confirmed.

Safe header template: Bearer <GITHUB_PERSONAL_ACCESS_TOKEN>. Replace only the named placeholder in protected client configuration.

Open provider setup or application page

Publisher documentation

Connect it

Live-validated endpoint: https://api.githubcopilot.com/mcp · Streamable HTTP. mcptest operator setup required: This provider requires a confidential application managed by the mcptest operator. Its client secret and token exchange stay server-side and must never be pasted into a browser.

Agent prompt for Claude Code or Codex

Add the GitHub MCP server to my MCP client configuration and verify that it works.

What it is: GitHub's official hosted MCP server for repository context, issues, pull requests, code search, and development workflows.
Server URL: https://api.githubcopilot.com/mcp
Transport: Streamable HTTP (remote MCP server, no local install).
Authentication: OAuth 2.1. mcptest operator setup required: This provider requires a confidential application managed by the mcptest operator. Its client secret and token exchange stay server-side and must never be pasted into a browser.
Tools: not yet observed by mcptest; tools/list will show them.
Reference: https://mcptest.io/servers/github/

Steps:
1. Work out which MCP client I use (Claude Code, Codex, Cursor, VS Code or another) and add the server under the name "github" in that client's MCP configuration, user scope unless I ask otherwise.
Claude Code: claude mcp add --transport http --scope user --header 'Authorization: Bearer '"${GITHUB_PERSONAL_ACCESS_TOKEN}" 'github' 'https://api.githubcopilot.com/mcp'
Codex: codex mcp add 'github' --url 'https://api.githubcopilot.com/mcp' --bearer-token-env-var 'GITHUB_PERSONAL_ACCESS_TOKEN'
Other clients: use the setup for that client on the reference page.
2. Never write a credential value into a file that could be committed; reference an environment variable or the client's secret store, and ask me for any value you need.
3. Verify: connect to the server and call tools/list. Confirm the tools above are listed, and report any sign-in step I still have to complete.

Claude Code setup

Run in a terminal. This user-scoped entry is available across projects.

claude mcp add --transport http --scope user --header 'Authorization: Bearer '"${GITHUB_PERSONAL_ACCESS_TOKEN}" 'github' 'https://api.githubcopilot.com/mcp'

Store GITHUB_PERSONAL_ACCESS_TOKEN in your operating system keychain, secret manager, or protected environment; never commit the value. The Authorization header syntax is Bearer <GITHUB_PERSONAL_ACCESS_TOKEN>.

Codex CLI setup

Run in a terminal; Codex stores the entry in ~/.codex/config.toml.

codex mcp add 'github' --url 'https://api.githubcopilot.com/mcp' --bearer-token-env-var 'GITHUB_PERSONAL_ACCESS_TOKEN'

Store GITHUB_PERSONAL_ACCESS_TOKEN in your operating system keychain, secret manager, or protected environment; never commit the value. The Authorization header syntax is Bearer <GITHUB_PERSONAL_ACCESS_TOKEN>.

Cursor setup

Add to .cursor/mcp.json for this project, or ~/.cursor/mcp.json for all projects.

{
  "mcpServers": {
    "github": {
      "url": "https://api.githubcopilot.com/mcp",
      "headers": {
        "Authorization": "Bearer ${env:GITHUB_PERSONAL_ACCESS_TOKEN}"
      }
    }
  }
}

Store GITHUB_PERSONAL_ACCESS_TOKEN in your operating system keychain, secret manager, or protected environment; never commit the value. The Authorization header syntax is Bearer <GITHUB_PERSONAL_ACCESS_TOKEN>.

VS Code setup

Add to .vscode/mcp.json, or run “MCP: Open User Configuration” for a private user-level entry.

{
  "servers": {
    "github": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp",
      "headers": {
        "Authorization": "Bearer ${input:github_personal_access_token}"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "github_personal_access_token",
      "description": "GITHUB_PERSONAL_ACCESS_TOKEN for GitHub",
      "password": true
    }
  ]
}

VS Code requests GITHUB_PERSONAL_ACCESS_TOKEN as a masked input; use a secret manager and do not put a default value in mcp.json. The Authorization syntax remains Bearer <GITHUB_PERSONAL_ACCESS_TOKEN>.

Claude setup

Add the endpoint above in Claude:

Customize > Connectors > Add custom connector
Team/Enterprise: Organization settings > Connectors > Add > Custom > Web

Claude Desktop setup

Add the endpoint above in Claude Desktop:

Remote: Customize > Connectors (same as claude.ai)
Local: Settings > Developer > Edit Config, or Settings > Extensions for .mcpb files
~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), local servers only

ChatGPT setup

Add the endpoint above in ChatGPT:

ChatGPT web: Plugins > Add custom MCP server, then configure authentication and accept the risk warning

Windsurf setup

Add the endpoint above in Windsurf:

~/.config/devin/mcp_config.json (%APPDATA%\devin\mcp_config.json on Windows), serverUrl or url
Cascade panel > ... > MCPs > Open MCP config file

Gemini CLI setup

Add the endpoint above in Gemini CLI:

gemini mcp add --transport http <name> <url>
~/.gemini/settings.json (user) or .gemini/settings.json (project), mcpServers

MCP SDK setup

Add the endpoint above in MCP SDK:

Programmatic: new Client(...).connect(new StreamableHTTPClientTransport(url))

Notes for every client

Provider setup: The mcptest operator creates and owns the GitHub OAuth or GitHub App.
Provider setup: Register the exact hosted mcptest callback URI.
Provider setup: Configure the client ID and client secret only in operator-controlled server bindings.
Provider setup: Retry hosted authorization after operator configuration is confirmed.
Publisher evidence (reviewed 2026-08-24): https://github.com/github/github-mcp-server/blob/main/docs/remote-server.md
Provider guidance: Browser OAuth requires the mcptest operator's GITHUB_OAUTH_CLIENT_ID and GITHUB_OAUTH_CLIENT_SECRET Worker bindings. Production readiness must not be claimed until both are configured; a GitHub personal access token remains an alternative.

Client compatibility

Client	Status	Why
Claude Code	Supported	Claude Code supports Streamable HTTP servers and OAuth sign-in or bearer-token headers.
Codex	Supported	Codex supports Streamable HTTP servers and OAuth sign-in or bearer-token headers.
Cursor	Supported	Cursor supports Streamable HTTP servers and OAuth sign-in or bearer-token headers.
VS Code	Supported	VS Code supports Streamable HTTP servers and OAuth sign-in or bearer-token headers.
Claude	Supported	Claude supports Streamable HTTP servers and OAuth sign-in or bearer-token headers.
Claude Desktop	Supported	Claude Desktop supports Streamable HTTP servers and OAuth sign-in or bearer-token headers.
ChatGPT	Supported	ChatGPT supports Streamable HTTP servers and OAuth sign-in or bearer-token headers.
Windsurf	Supported	Windsurf supports Streamable HTTP servers and OAuth sign-in or bearer-token headers.
Gemini CLI	Supported	Gemini CLI supports Streamable HTTP servers and OAuth sign-in or bearer-token headers.
MCP SDK	Supported	MCP SDK supports Streamable HTTP servers and OAuth sign-in or bearer-token headers.

Computed from this server's validated transport, protocol and authentication against documented client support. Checks the catalog has not observed are not counted.

Similar servers

MCP Registry Server — MCP interface for searching and publishing servers through the official Model Context Protocol Registry backend. No authentication
GitLab — GitLab's hosted MCP server exposes project, issue, merge-request, pipeline, and repository workflows. OAuth 2.1
CircleCI — CircleCI's hosted MCP server helps inspect pipelines, builds, tests, failures, and delivery workflows. OAuth 2.1
Sanity — Runs GROQ queries, creates and patches documents, manages releases, and reads schemas in Sanity projects. Uses OAuth by default; Sanity also documents token-based authentication. OAuth 2.1
Buildkite — Reads Buildkite pipelines, builds, jobs, logs, artifacts, and test results. This endpoint uses OAuth; headless agents can send an API token to the /direct endpoint. OAuth 2.1
Jam — Reads Jam bug reports, including console logs, network requests, user events, and screenshots, so assistants can debug captured issues. Requires Jam OAuth. OAuth 2.1

Guides for this server

Watch this server for breaking changes

Share and embed

Maintain GitHub? Embed this badge in your README. It follows the latest catalog validation result and links to this server profile.

Markdown

[![Tested on mcptest.io](https://mcptest.io/badge/server/github.svg)](https://mcptest.io/servers/github/)

HTML

<a href="https://mcptest.io/servers/github/"><img src="https://mcptest.io/badge/server/github.svg" alt="Tested on mcptest.io"></a>

reStructuredText

.. image:: https://mcptest.io/badge/server/github.svg
   :alt: Tested on mcptest.io
   :target: https://mcptest.io/servers/github/

Latest validation evidence

Validation status: Online when last tested
Validation checked at: Oct 26, 2026 at 2:07 PM
Validation detail: Authentication challenge at https://api.githubcopilot.com/mcp returned HTTP 401; endpoint was reachable but did not complete an MCP probe; authentication oauth

Tool inventory

Requires authorization; inventory not observed

The catalog validator lists tools only on servers that answer without credentials. GitHub asks for OAuth 2.1 sign-in first, so its tools, resources and prompts were not observed. Connect in the Playground with your own credentials to list them.