Provides tools for interacting with GitHub's hosted MCP server, specifically to list open pull requests on behalf of the user, with access managed via short-lived tokens from Keycard.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Getting Started MCP list my open pull requests on GitHub"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server that reads GitHub on your behalf using short-lived tokens from Keycard for each call.
Run it locally, connect Claude Code, and reads will appear in the Keycard console under your name.
whoami answers as you, reading claims from your Keycard zone. At startup the server authenticates as itself with the credential in .env and reads the claims of the token Keycard issues it. That issuance appears in the Keycard console with the application as the subject, rather than you.
list_pull_requests returns your open pull requests. The server asks Keycard for a token scoped to you, spends it on GitHub's hosted MCP server, and discards it. This call appears in the Keycard console with you as the subject, rather than the application.
Related MCP server: GitHub MCP Connector
You need Python 3.12 or later, uv, and a Keycard account.
Clone the project and move into it.
git clone https://github.com/keycardai/getting-started-mcp local-tools
cd local-toolsInstall the Keycard CLI and enroll the project.
brew install keycardai/tap/keycard
keycard new mcpkeycard new mcp creates the local-tools application in your zone, mints a credential for local development, and writes .env.
Install dependencies and start the server.
make install
make devThe server listens on http://localhost:8181/mcp. Open Activity in the Keycard console and you'll see the startup whoami call attributed to local-tools.
Add GitHub as a dependency of the application.
In the console: go to Dependencies, choose Add Dependency, then Add Resource, and pick GitHub MCP. Keycard walks you through connecting GitHub and then holds tokens for you.
Connect Claude Code.
claude mcp add --transport http --scope local local-tools http://localhost:8181/mcp
claudeAsk Claude Code to list open pull requests. You sign in, consent to using GitHub, and the read comes back. Activity records the grant and the read with you as the subject.
Two exchanges, and neither one puts a GitHub credential in this repository.
At startup the server authenticates to your Keycard zone with its own client ID and secret from .env, a plain OAuth client credentials grant, and reads the claims of the token it is issued. UserInfo is a user endpoint and does not accept an application as its subject, so the server shows its own token rather than calling UserInfo as itself.
To list pull requests the server hands the caller's token to Keycard using RFC 8693 token exchange to get back a token scoped to the request. Keycard decides whether to issue the token by ensuring the resource is a dependency of the application and that you consented to the use. The token comes back scoped to one resource and the server throws it away after the call.
So .env holds exactly one secret: the application's own. GitHub's credential lives in Keycard, and nothing in this project can read it.
Every value comes from .env, which is written by keycard new mcp and loaded at startup.
Variable | What it does | Default |
| Your Keycard zone. Required. | none |
| The application's client ID, written by | none |
| Its secret, written by | none |
| The URL Keycard knows this server by. |
|
| Port the HTTP transport binds to. |
|
| Address it binds to. |
|
| Override the UserInfo endpoint. | derived from the zone URL |
| Whether to announce the application at startup. | on locally, off on Vercel |
The server runs without KEYCARD_CLIENT_ID and KEYCARD_CLIENT_SECRET, so you can start it before you enroll. It logs a warning and skips the startup call.
On Vercel the server does not announce itself, which is why KEYCARD_STARTUP_IDENTITY_CHECK stays off there. The platform's OIDC token arrives per request (x-vercel-oidc-token) rather than with the process, so a startup hook has nothing to present. The deployed server uses that token to authenticate each tool call's token exchange, and the deployment shows up in Activity through the first real call.
Run make to see the list.
Command | What it does |
| Install dependencies. |
| Run the server with debug logging. |
| Run the server. |
| Type-check the source. |
| Push selected |
| Pull the Vercel environment into |
| List the environment set on the Vercel project. |
make env-push sends KEYCARD_ZONE_URL from .env to the linked Vercel project. It does not send KEYCARD_CLIENT_ID or KEYCARD_CLIENT_SECRET. The deployed server authenticates with Vercel's workload identity. Redeploy after it runs.
Path | Holds |
| Tool definitions, the startup hook, and the entry point. |
| GitHub MCP calls. Takes a token, knows nothing about Keycard. |
| Identity reads: your UserInfo answer (the |
| Environment-derived settings. |
| The |
We're still building the Vercel path, and the production credential handling remains unfinished. Run vercel deploy, then give the console your Vercel team slug, project name, and the deployed URL. Keycard creates a provider for your team, registers the deployed endpoint, and issues a workload identity credential keyed to it.
The deployed server holds no secret at all. Vercel mints a short-lived OIDC token for every function invocation, Keycard trusts your team's issuer, and the exchange happens against that. The client ID and secret in .env stay local.
The deployed server does not announce an identity of its own. Each tool call authenticates its token exchange with the workload identity, so the deployment shows up on the Activity feed through the first real call rather than through a separate self-issued announcement.
If startup fails with KEYCARD_ZONE_URL is not set, you haven't run keycard new mcp yet.
If the log says no application credential was found, you haven't run keycard new mcp yet. The server still serves; only the startup identity call is skipped.
If a GitHub tool returns a token exchange error, GitHub isn't a dependency of the application yet, or you haven't consented to this agent using it. Both are fixed in the console under Dependencies.
If your agent can't connect, check that MCP_SERVER_URL matches the URL you gave it, including the /mcp path. Keycard pins the token audience to that value, so a mismatch shows up as a rejected token.
Apache-2.0 — see LICENSE and, for the copyright notice, NOTICE. The Keycard name and logo are trademarks; TRADEMARKS.md states how they may be used.
This server cannot be deployed
Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.
Human-authenticated setup for routing GitHub pull requests into the right Slack channel.
Human-authenticated setup for routing GitHub pull requests into the right Slack channel.
Connect AI assistants to your GitHub-hosted Obsidian vault to seamlessly access, search, and analy…
