ars-nova-github-max

Gloves-off GitHub MCP server for Claude custom connectors. Full REST + GraphQL passthrough, so it can do anything GitHub's API can do — including the three operations the stock github-mcp-server has never had:

• delete_branch

• create_release

• upload_release_asset

Built 2026-08-13 to replace the github connector entry in Claude Desktop.

Why it exists

The stock GitHub MCP server has no branch-deletion tool in any toolset, and its release tools are read-only (list_releases, get_latest_release, get_release_by_tag). That gap was hit twice during plugin release work.

Rather than hand-write the three missing tools, this server exposes gh_api — an any-method, any-path REST passthrough. It therefore covers every endpoint GitHub has now and everything they ship later, with no code change here. The named tools are thin conveniences over that same primitive.

Deliberately not a local stdio server: the Cloud Run version keeps working when the laptop is off, and — the deciding factor — scheduled tasks run in fresh cloud sessions with no desktop attached, so a local connector is invisible to them.

Related MCP server: GitHub MCP Server Plus

Design notes

Follows the ars-nova-gcloud-mcp pattern (see claude/infra/ANS_gcloud_MCP_Build.md): stateless Streamable HTTP transport, one Server + transport per request, ?key= token auth, MCP_DISABLED kill switch, single-line JSON audit records on stdout.

One difference worth knowing. The gcloud MCP's headline safety property is "no shell, ever" — it spawns binaries with an argv array so metacharacters stay inert. This server never spawns a process at all; every operation is an HTTPS request built from structured fields. There is no command-injection surface.

What replaces it as the thing to get right is authorization scope, because the token is a full org read/write PAT. Two guards cover that:

Org allowlist. Requests are refused unless they target an allowlisted owner (GITHUB_ALLOWED_OWNERS, default ArsNovaSingers). Endpoints scoped to the token itself — /user, /rate_limit, /search/* — carry no third-party owner and pass through.

Confirm gate. Four irreversible operations require an exact typed phrase, which the error message states:

Branch deletion is deliberately not gated — tidying branches is the whole point, and a deleted branch is recoverable by re-creating a ref at its old SHA. Repository deletion is not recoverable, which is why it is.

Environment

Kill switch

gcloud run services update ars-nova-github-max \
  --region us-central1 --project ars-nova-org-mcp \
  --update-env-vars MCP_DISABLED=1

Tools

Known limitation

The org allowlist cannot be structurally enforced on arbitrary GraphQL, since the owner lives inside a free-form query document. gh_graphql logs every call and flags mutations in the audit trail. Prefer gh_api for writes where a REST equivalent exists.