GitHub MCP

A GitHub MCP server for Claude and other MCP clients. No OAuth — it uses a GitHub Personal Access Token, protected by a shared bearer token so only your clients can reach it.

22 tools across repos, files, search, branches, commits, pull requests, issues, and releases.

Read SECURITY.md before deploying. This server exposes a PAT over HTTP. Anyone who can reach the URL and present the auth token inherits that token's access to your repositories.

Quick start

1. Create a GitHub PAT

https://github.com/settings/tokens?type=beta → Generate new token

Scopes: repo, read:org, read:user, workflow.

Prefer a fine-grained token limited to specific repositories — that is the strongest control available here, stronger than anything the server enforces.

2. Generate a server auth token

openssl rand -hex 32

This is the secret your MCP client presents to the server. It is not your GitHub PAT — keep the two separate.

3. Deploy

Any Node 20+ host or container platform works. Config is included for the common ones:

Not compatible: Cloudflare Workers, Vercel/Netlify functions. Both need a long-lived process for sessions and SSE. See DEPLOYMENT.md.

Locally, or on any VM:

npm ci && npm run build
GITHUB_TOKEN=... MCP_AUTH_TOKEN=... npm start

The server refuses to start without a valid MCP_AUTH_TOKEN. That is deliberate — it never comes up unauthenticated.

Two settings matter on every platform:

• TLS. The auth token is a bearer header on every request. Managed platforms terminate TLS for you; on a bare VM you must add a proxy that does.

• TRUST_PROXY. 1 behind a proxy, 0 (the default) when Node is exposed directly. Wrong value silently disables rate limiting — details.

Run one instance — sessions are held in memory.

4. Connect your client

{
  "mcpServers": {
    "github": {
      "type": "http",
      "url": "https://your-app.onrender.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_MCP_AUTH_TOKEN" }
    }
  }
}

If your client cannot send custom headers, set MCP_ALLOW_QUERY_TOKEN=true and append the token to the URL:

https://your-app.onrender.com/mcp?key=YOUR_MCP_AUTH_TOKEN

This is weaker — URLs end up in proxy logs, browser history, and referrer headers — so prefer the header wherever the client supports it.

Related MCP server: GitHub MCP Connector

Configuration

See .env.example for a copyable template.

Security summary

• Bearer auth on every MCP route, compared in constant time

• Fail-closed startup — no token, no server

• Origin allowlisting (DNS-rebinding defense) and CORS off by default

• Brute-force limiting: 20 failed auth attempts per IP per 15 min

• Bounded sessions with idle sweeping

• Optional read-only mode and per-repo allowlisting

• helmet headers, generic error responses

• X-Forwarded-For ignored by default, so rate limiting cannot be spoofed past

Full detail and the hardening checklist: SECURITY.md.

Transports

• Streamable HTTP (current): POST/GET/DELETE on /mcp

• SSE (deprecated): GET /sse + POST /message

Sessions are held in memory, so run a single instance. Multiple replicas behind a load balancer will break sessions.

Development

npm ci
cp .env.example .env    # fill in GITHUB_TOKEN and MCP_AUTH_TOKEN
npm run dev

Docs

• DEPLOYMENT.md — platform compatibility, DigitalOcean guides, TLS

• SECURITY.md — threat model, controls, hardening checklist

License

MIT — see LICENSE.