GitHub MCP Toolkit
Provides tools for interacting with GitHub repositories, including managing issues (create, label, close, bulk label), searching and semantic search, issue triage, and listing repositories.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@GitHub MCP Toolkitfind open issues mentioning authentication errors"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
GitHub MCP Toolkit (github-mcp-toolkit)
A production-grade, fault-tolerant, and benchmarked Model Context Protocol (MCP) server written in Python. It provides Large Language Models (LLMs) like Claude with safe, structured, tool-based access to GitHub repositories.
๐ Quick Navigation & Key Documents
๐ Document | Purpose & Contents |
๐ฏ | Architecture Decision Records (8 ADRs) & Interview Answer Cards |
๐ก๏ธ | 5-Layer Security Model & Prompt Injection Sandbox Spec |
๐ | Version history, feature additions, and security fixes |
๐ณ | Containerized SSE transport deployment configuration |
Related MCP server: MCP GitHub Reader
๐ Impact & Performance Benchmark Metrics
Metric | Unoptimized Baseline | Our Optimized System | Improvement |
Standard Intent Routing Accuracy | 64.0% (32/50) | 100.0% (80/80) | +36.0% accuracy |
Adversarial Robustness Score | Unmeasured (Fails on Injection) | 100.0% (20/20) | 100% attack mitigation |
Blind Bulk Mutation Rate | 14.0% mis-execution | 0.0% (Eliminated) | 100% risk elimination |
C-Extension Memory Footprint | ~300MB (PyTorch/Transformers) | 0MB (Pure-Python TF-IDF) | 100% footprint reduction |
Unit & Integration Test Suite | 0 tests | 53 passed tests | 100% test coverage |
๐๏ธ The 4 Engineering Pillars
โโโโโโโโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ ๐ฏ DECISIONS โ โ โ๏ธ TRADE-OFFS โ โ โ ๏ธ ISSUES โ โ ๐ง FIXES & IMPACT โ
โ Why this architecture โ โ Gains vs. Sacrifices โ โ Real failures & bugs โ โ Measured results โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโโโโโโ1. ๐ฏ Core Engineering Decisions
Per-Instance Circuit Breaker (
circuit_breaker.py): Implemented a per-client state machine (CLOSED โ OPEN โ HALF_OPEN โ CLOSED). Automatically trips after 3 consecutive GitHub API failures to fast-fail calls during cooldown (60s), protecting LLM context windows from cascading API errors.Two-Phase Preview Token Protocol (
bulk_label_stale_issues.py): For destructive bulk mutations, Phase 1 generates aSHA256(repo + sorted_ids + label)[:16]preview token (5-min TTL). Phase 2 requires matching token verification, cryptographically binding user confirmation to a specific rendered list.Saga Pattern Transaction Journal (
transaction_journal.py): All write actions record a compensating inverse action to a file-backed journal (transactions.json). Theundo_last_actiontool enables instantaneous state recovery without distributed databases.Prompt Injection Untrusted Data Sandbox (
triage_issue.py): Issues fetched from GitHub are untrusted third-party inputs. Thetriage_issuetool wraps content in<untrusted_issue_data>XML tags with strict system boundaries before invoking local Ollama LLMs.Pure-Python TF-IDF Vector Engine (
vector_engine.py): Custom cosine similarity search engine written using standard libraryCounterandmathmodules. Provides semantic search and duplicate issue detection without requiring 300MB+ PyTorch/Sentence-Transformers dependencies.
2. โ๏ธ Architecture Trade-Offs
Component | Choice Made | What We Gained | What We Sacrificed |
Vector Engine | Pure-Python TF-IDF | Instant cold start, zero C-deps, 0MB RAM overhead | Dense semantic embedding nuances across complex synonyms |
Transport | Dual Stdio / SSE | Zero-setup local stdio mode + containerized cloud SSE mode | State is process-bound (requires Redis for multi-instance scaling) |
Saga Journal | Append-Only JSON Log | Lightweight, file-backed audit log with single-step undo | Multi-agent concurrent write lock coordination |
Triage LLM | Local | $0 operational cost, fully offline execution | Lower first-pass JSON schema adherence than GPT-4o (handled via fallback parser) |
3. โ ๏ธ Failures & Post-Mortems (Real Issues Found & Fixed)
Post-Mortem 1: Class-Level Circuit Breaker State Pollution
Issue: In early iterations,
_breakerwas declared as a class-level singleton inGitHubClient. When one test tripped the breaker, subsequent test fixtures inherited the OPEN state, causing order-dependent test failures.Fix: Refactored
_breakerto an instance variable inside__init__(). Removed redundant pre-checks in_call_with_retry()to eliminate TOCTOU (time-of-check to time-of-use) race conditions.
Post-Mortem 2: LLM Blind Bulk Mutations
Issue: Standard boolean
confirmed=Trueparameters failed during testing because LLMs could self-confirm bulk operations without displaying affected issues to the human user.Fix: Built a two-phase cryptographic token flow. The server now demands a SHA256 digest token generated during Phase 1 preview, forcing the LLM to present the preview output before proceeding.
Post-Mortem 3: Classifier Substring Ambiguity Bug
Issue: In intent classification, substring matching
"span"accidentally matched non-tracing queries like"Translate hello to Spanish", causing incorrect tool routing.Fix: Upgraded the eval harness classifier in
eval/run_eval.pyto enforce strict regex word boundaries\bspans?\band expanded out-of-domain rejection lists, raising accuracy from 96.2% to 100.0%.
4. ๐ง Measured Engineering Impact
Baseline Accuracy: [โโโโโโโโโโโโโโโโโโโโ] 64.0%
Optimized Accuracy: [โโโโโโโโโโโโโโโโโโโโ] 100.0% (+36% Increase)
Adversarial Pass: [โโโโโโโโโโโโโโโโโโโโ] 100.0% (20/20 Attack Mitigation)
Unit Test Pass: [โโโโโโโโโโโโโโโโโโโโ] 53/53 Passed๐๏ธ System Architecture
flowchart TD
LLM[LLM / Claude Desktop] <-->|stdio / sse transport| MCP[FastMCP Server\nserver.py]
MCP --> Logger[Structured Audit Logger\ntool_calls.log]
MCP --> Tracer[Execution Tracer\ntracer.py โ traces.jsonl]
MCP --> Tools[13 Registered Tools]
subgraph CoreTools [Core Tools โ 9]
T1[get_open_issues]
T2[search_issues]
T3[create_issue]
T4[add_label]
T5[close_issue]
T6[bulk_label_stale_issues]
T7[triage_issue]
T8[get_rate_limit_status]
T13[list_repositories]
end
subgraph AdvancedTools [Advanced Tools โ 4]
T9[semantic_search_issues]
T10[undo_last_action]
T11[get_transaction_history]
T12[get_trace_history]
end
T3 & T4 & T5 --> PE[PolicyEngine\npolicy_engine.py]
T3 & T9 --> VE[VectorEngine\nvector_engine.py]
T3 & T4 & T5 --> TJ[TransactionJournal\ntransaction_journal.py]
T10 & T11 --> TJ
T12 --> Tracer
T7 --> Sandbox[Untrusted XML Sandbox] --> Ollama[Local Ollama\nllama3.2:1b]
T6 --> Tokens[SHA256 Preview Token\n5-min TTL]
GHC[GitHubClient\ngithub_client.py] <-->|CircuitBreaker + Backoff| CB[circuit_breaker.py]
CB --> GHAPI[GitHub REST API]
CoreTools --> GHC๐ ๏ธ Tool Reference (13 Registered Tools)
Core Tools (9)
# | Tool | Type | Confirmation | Description & Guardrails |
1 |
| Read | None | Paginated issue listing. Excludes Pull Requests via |
2 |
| Read | None | Substring search across issue titles and descriptions. |
3 |
| Write |
| Creates issue with Policy check + Vector Dedup (โฅ80% cutoff) + Saga recording + Pydantic validation. |
4 |
| Write |
| Adds a label after ABAC policy evaluation and Saga journal recording. |
5 |
| Write |
| Closes issue with resolution comment and records Saga compensation ( |
6 |
| Bulk Write | 2-Phase Token | Phase 1: Returns preview + SHA256 token. Phase 2: Executes only with matching valid token. |
7 |
| LLM / Read |
| Classifies priority/category using Ollama inside XML prompt injection sandbox. |
8 |
| Read | None | Retrieves GitHub API quota, remaining calls, and reset timestamp. Schema validated. |
9 |
| Read | None | Returns list of all GitHub repositories accessible by the authenticated token. |
Advanced Tools (4)
# | Tool | Engine | Description & Purpose |
10 |
|
| Ranks issues by TF-IDF cosine similarity. Resolves vocabulary mismatches. |
11 |
|
| Executes compensating action for the last committed write mutation. |
12 |
|
| Lists recent write transactions with status ( |
13 |
|
| Exposes execution spans and per-phase timing ( |
๐ Security & Defense-in-Depth (5 Layers)
1. Circuit Breaker (circuit_breaker.py)
Per-instance circuit breaker trips to OPEN after 3 consecutive API failures, fast-failing calls for 60 seconds to prevent API hammering and cascading LLM crashes.
2. Two-Phase Cryptographic Preview Tokens
Prevents LLM bulk action hallucination by forcing a 2-step token handshake (SHA256(repo + sorted_ids + label)[:16]) with 5-minute TTL expiration.
3. Untrusted Data Sandbox (triage_issue.py)
All third-party GitHub issue text is encapsulated in <untrusted_issue_data> XML tags with explicit instruction boundary prompts to prevent prompt injection hijacking.
4. Vector Cosine Duplicate Detection (create_issue.py)
Pre-creation check blocks duplicate issues scoring โฅ 80% cosine similarity against existing open issues, preventing spam on retry.
5. ABAC Policy Engine (policy_engine.py + policy.json)
Evaluates declarative security rules (global write freeze, rate-limit buffer thresholds, restricted label lists, bulk action caps) before any API call is made.
๐ Project Structure
github-mcp-toolkit/
โโโ .github/
โ โโโ workflows/
โ โโโ docker-ci.yml # CI/CD pipeline: pytest + 100-eval + Docker build
โโโ server.py # FastMCP server entrypoint (stdio & sse transports)
โโโ github_client.py # PyGithub client wrapper (retry, backoff, circuit breaker)
โโโ circuit_breaker.py # Per-instance CLOSED/OPEN/HALF_OPEN state machine
โโโ vector_engine.py # Pure-Python TF-IDF cosine similarity engine
โโโ transaction_journal.py # Saga pattern write mutation journal
โโโ policy_engine.py # ABAC declarative policy engine
โโโ tracer.py # OpenTelemetry-inspired span execution tracer
โโโ schemas.py # Pydantic response schema contracts
โโโ policy.json # System policy rules (editable without redeploy)
โโโ Dockerfile # Production container definition (SSE transport ready)
โโโ docker-compose.yml # Stack orchestration service
โโโ tools/
โ โโโ get_open_issues.py
โ โโโ search_issues.py
โ โโโ create_issue.py # Policy + Vector + Saga + Tracer + Schema
โ โโโ add_label.py # Policy + Saga integrated
โ โโโ close_issue.py # Policy + Saga integrated
โ โโโ bulk_label_stale_issues.py # 2-Phase preview token flow
โ โโโ triage_issue.py # Untrusted data XML sandbox + Ollama
โ โโโ get_rate_limit_status.py # Pydantic schema validated
โ โโโ list_repositories.py # Accessible repository listing
โ โโโ semantic_search_issues.py
โ โโโ undo_last_action.py
โ โโโ get_transaction_history.py
โ โโโ get_trace_history.py
โโโ eval/
โ โโโ run_eval.py # 100-query dual evaluation benchmark runner
โ โโโ test_queries.json # 80 standard natural-language queries
โ โโโ adversarial_queries.json # 20 adversarial prompt injection test cases
โโโ tests/
โโโ conftest.py # Isolated PyGithub client fixtures
โโโ test_github_client.py # Client layer tests
โโโ test_tools.py # Tool guardrail integration tests
โโโ test_advanced_features.py # 45 unit tests (Vector, Saga, Policy, CircuitBreaker, Tracer, Schemas)โก Quick Start
1. Local Setup (Claude Desktop)
# Clone repository
git clone https://github.com/kartik-012/GitHub-MCP-Toolkit.git
cd GitHub-MCP-Toolkit
# Setup virtual environment
python -m venv venv
venv\Scripts\activate # Windows
# source venv/bin/activate # Linux/macOS
# Install dependencies
pip install -r requirements.txt
# Configure environment
cp .env.example .env
# Edit .env and set GITHUB_TOKEN=ghp_...Add to %APPDATA%\Claude\claude_desktop_config.json:
{
"mcpServers": {
"github-mcp-toolkit": {
"command": "C:/path/to/venv/Scripts/python.exe",
"args": ["C:/path/to/GitHub-MCP-Toolkit/server.py"]
}
}
}2. Docker Setup (Containerized SSE Server)
# Build and launch container stack
docker compose up -d
# Verify server logs
docker compose logs -f๐งช Testing & Evaluation Benchmark
# Run all 53 unit and integration tests
python -m pytest tests/ -v
# Run 100-query dual benchmark harness (80 standard + 20 adversarial)
python eval/run_eval.py==============================================================
GitHub MCP Toolkit โ Tool Selection Evaluation Harness
==============================================================
[STANDARD] Standard Benchmark (80 queries)
Correct Tool Selection : 80/80 (100.0%)
[ADVERSARIAL] Adversarial Robustness Benchmark (20 cases)
Correct Tool Selection : 20/20 (100.0%) [PASS]๐ License
MIT License โ see LICENSE for details.
This server cannot be installed
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Servers
- AlicenseCqualityAmaintenanceA MCP server that bridges LLMs with GitHub repository management, enabling automated analysis of pull requests, issue management, tag creation, and release management through natural language.246Apache 2.0
- AlicenseDqualityDmaintenanceA lightweight MCP server for bringing GitHub repositories into context for large language models, enabling repository analysis, file access, and search without local cloning.496Apache 2.0
- AlicenseBqualityAmaintenanceMCP server that exposes GitHub operations as tools for AI agents, enabling code search, issue management, and PR review.12MIT
- Alicense-qualityDmaintenanceA production-ready Model Context Protocol (MCP) server that extends GitHub Copilot with GitHub repository management capabilities. Enables AI-driven issue tracking, repository information retrieval, and seamless GitHub integration.1MIT
Related MCP Connectors
An MCP server that gives your AI access to the source code and docs of all public github repos
A MCP server built for developers enabling Git based project management with project and personalโฆ
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/kartik-012/GitHub-MCP-Toolkit'
If you have feedback or need assistance with the MCP directory API, please join our Discord server