github-mcp-lite

A minimal MCP (Model Context Protocol) server for creating GitHub repositories, committing files, and publishing releases using a plain Personal Access Token (PAT).

No Docker, no local Git installation, and no GitHub Copilot subscription required — unlike the hosted api.githubcopilot.com/mcp/ server, which gates access behind a Copilot entitlement. This server talks directly to the regular GitHub REST API (api.github.com) over plain fetch, so it's a single dependency-light file you can read top to bottom in a few minutes.

Why this exists

Most MCP GitHub integrations either require a full local git toolchain, a Docker container, or a Copilot-gated hosted endpoint. github-mcp-lite is for cases where you just want an AI assistant to be able to:

• spin up a new repo,

• push a batch of files to it in one commit, and

• tag a release,

using nothing but a token you already have.

Related MCP server: mcp-github-server

Tools

Each tool is annotated with readOnlyHint / destructiveHint / openWorldHint metadata so MCP clients can surface appropriate confirmation prompts.

get_authenticated_user

No input. Returns { login, html_url, name } for the token's owner.

list_repositories

Wraps GET /user/repos, sorted by most recently updated. Returns an array of { full_name, private, language, updated_at, html_url }. Results are paginated — a full page means you should ask for the next one.

create_repository

Returns { full_name, html_url, clone_url, default_branch }.

commit_files

Internally this creates blobs, a tree, and a commit via the Git Data API, then fast-forwards the branch ref — so it's a real single commit, not one commit per file. Returns { commit_sha, html_url, files_changed }.

commit_directory

Use this instead of commit_files when pushing a whole project. Inside a git work tree it defers to git ls-files so .gitignore is honoured; otherwise it walks the directory and prunes the usual junk (node_modules, .git, dist, build, .next, coverage). Binary files are detected and uploaded as blobs; text files are inlined into the tree, and the tree is built in chunks so a large project stays within a handful of round trips. Returns { commit_sha, html_url, files_uploaded, skipped }.

Note: this merges onto the existing tree — it adds and updates files but never deletes. A file removed locally will still be present on GitHub.

create_release

Returns { html_url, id, tag_name }.

delete_repository

Permanently deletes the repository. Returns { deleted: true, full_name }. Requires a classic PAT with the delete_repo scope — fine-grained tokens generally cannot delete repositories.

github_request

An escape hatch for anything the dedicated tools don't cover: code scanning and secret scanning alerts, deployments, commit statuses, repository invitations, issues, pull requests, orgs, gists. path is everything after https://api.github.com, e.g. /repos/OWNER/REPO/code-scanning/alerts. Returns the parsed JSON response.

One generic tool rather than a wrapper per endpoint means the server can't fall behind your token — a scope you add later is reachable with no code change.

Warning: this carries the token's full authority, including DELETE on any resource the token can reach. It is annotated destructiveHint: true. If you want the reach without the risk, narrow the method enum in index.js to GET and it becomes a read-only window over every scope.

Paths are validated to begin with a single /, so absolute URLs (https://…) and protocol-relative paths (//…) are rejected — without that, a crafted path would send your bearer token to another host. test.js covers this; run it with node test.js.

Installation

Prerequisites

• Node.js 18+ (for native fetch support)

• A GitHub Personal Access Token with the repo scope (add delete_repo too if you want to use delete_repository)

Note: Repository creation isn't reliably supported by fine-grained PATs, so a classic token is recommended.

Clone and install dependencies

git clone https://github.com/MatinMHF/github-mcp-lite.git
cd github-mcp-lite
npm install

Configure your token

The server reads the token from either GITHUB_PERSONAL_ACCESS_TOKEN or GITHUB_TOKEN in its environment. Set one of these before it starts — the process exits immediately with an error if neither is present.

Usage

Run directly

GITHUB_PERSONAL_ACCESS_TOKEN=ghp_xxx node index.js

The server communicates over stdio, so it's meant to be launched by an MCP client (Claude Code, Claude Desktop, etc.), not run interactively on its own.

Register with Claude Code

claude mcp add github-lite -s user -e GITHUB_PERSONAL_ACCESS_TOKEN=<your_token> -- node /path/to/index.js

On Windows PowerShell, quote the separator as "--" — PowerShell silently strips a bare -- before it reaches the script's arguments, which breaks argument parsing:

claude mcp add github-lite -s user -e GITHUB_PERSONAL_ACCESS_TOKEN=<your_token> "--" node "C:/path/to/index.js"

Register with Claude Desktop (or any MCP-compatible client)

Add an entry to your client's MCP server config (e.g. claude_desktop_config.json):

{
  "mcpServers": {
    "github-lite": {
      "command": "node",
      "args": ["C:/path/to/github-mcp-lite/index.js"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_xxx"
      }
    }
  }
}

Example workflow

A typical session once the server is registered with your MCP client:

1. "Who am I authenticated as?" → calls get_authenticated_user

2. "Create a public repo called my-project" → calls create_repository (auto-initializes with a README so a default branch exists)

3. "Commit these files to it" → calls commit_files with an array of { path, content } entries, written in a single commit

4. "Publish a v1.0.0 release" → calls create_release

Security notes

• The token is read once from the environment at startup and never logged.

• commit_files, commit_directory, delete_repository and github_request are marked destructiveHint: true in their tool annotations — well-behaved MCP clients should prompt for confirmation before invoking them.

• github_request is the widest of these: it can reach any endpoint the token is allowed to reach, with any verb. On a classic PAT the repo scope also grants its children — repo:status, repo_deployment, public_repo, repo:invite and security_events — which cannot be unticked individually. That last one means read and write access to code scanning and secret scanning alerts across every repo you own. A fine-grained token scoped to Contents, Administration and Metadata avoids it, at the cost of repository creation being unreliable.

• Because this server has openWorldHint: true on every tool (it makes real network calls to api.github.com), only run it with a token scoped to what you actually need.

Contributing

See CONTRIBUTING.md for guidelines. This project follows a Code of Conduct. To report a security issue, see SECURITY.md.

License

MIT