GitHub MCP Server

Reviewed 2026-10-15devopsPrompt / Rule# github # mcp # devops # pull-requests # issues

GitHub's own MCP server: lets an agent read repositories and manage issues, pull requests, Actions runs and security alerts through your GitHub account, as a hosted remote server or a local Docker image.

Security Reviewed

Official GitHub server; acts in your GitHub account with your token; read-only mode available; destructive tools exist.

Install GitHub MCP Server in Google Antigravity

Antigravity loads skills from .agents/skills/ in your project or ~/.gemini/config/skills/ for all projects (official docs). Full guide

EasiestOption 1: paste this to your Antigravity agent

Install the "GitHub MCP Server" skill for Google Antigravity.
Follow the steps at https://www.antigravityskills.org/install/github-mcp-server.md (source: https://github.com/github/github-mcp-server).
Before running anything, show me what you will download and whether it includes scripts, and wait for my OK.
Install it into this project (.agents/skills/) unless I say global. When done, check that Antigravity lists it as an installed skill.

The agent reads the install file, shows you what it will download and waits for your OK.

Option 2: install it yourself

1. Create a GitHub token (or plan to use OAuth)
The repo's Antigravity guide uses a Personal Access Token and suggests the scopes repo, read:org and read:user. Create it at https://github.com/settings/tokens, or use a fine-grained token limited to the repositories you want the agent to touch. Treat it like a password.
2. Open the MCP config in Antigravity
Per the guide: Agent panel '...' menu > MCP Servers > Manage MCP Servers > View raw config. It opens mcp_config.json, which the guide places at ~/.gemini/antigravity/mcp_config.json (macOS/Linux) or C:\Users\<USERNAME>\.gemini\antigravity\mcp_config.json (Windows). Newer Antigravity builds also have Settings > Customizations; we have not tested which location your version uses.
3. Add the remote server (recommended by the repo)
```
{
  "mcpServers": {
    "github": {
      "serverUrl": "https://api.githubcopilot.com/mcp/",
      "headers": {
        "Authorization": "Bearer YOUR_GITHUB_PAT"
      }
    }
  }
}
```
Antigravity uses serverUrl, not url, for HTTP servers; using url gives 'serverUrl or command must be specified'. Replace YOUR_GITHUB_PAT with your token. Optional: add "X-MCP-Readonly": "true" and "X-MCP-Toolsets": "repos,issues,pull_requests" under headers (documented in docs/remote-server.md) to start read-only with fewer tools.

4. Or run it locally with Docker

{
  "mcpServers": {
    "github": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN", "-e", "GITHUB_READ_ONLY=1", "ghcr.io/github/github-mcp-server"],
      "env": {"GITHUB_PERSONAL_ACCESS_TOKEN": "YOUR_GITHUB_PAT"}
    }
  }
}

Requires Docker running and on your PATH. This is the guide's PAT variant plus the README's GITHUB_READ_ONLY=1. The guide also shows an OAuth variant that publishes 127.0.0.1:8085 for the login callback.

5. Restart Antigravity and check
Close and reopen Antigravity, then open the MCP Servers panel: 'github' should list its tools. The guide notes the status dot may not turn green in some versions even when the tools work. Try the read-only example prompt first.

This is an MCP server, not a skill folder, so nothing goes in .agents/skills/. Steps follow docs/installation-guides/install-antigravity.md at the reviewed commit; we have not run them in Antigravity.

Using Claude Code, Cursor or Codex? See other assistants below.

What is GitHub MCP Server?

The GitHub MCP Server is an MCP server maintained by GitHub that exposes the GitHub API to an AI agent as tools. Once connected, the agent can search code, read files, open and comment on issues and pull requests, look at Actions runs, and see code-scanning, Dependabot and secret-scanning findings, with the permissions of whatever token or login you give it. It is a connector, not a prompt skill: nothing is copied into .agents/skills/. You either point your client at GitHub's hosted endpoint (https://api.githubcopilot.com/mcp/) or run the ghcr.io/github/github-mcp-server image yourself.

How to use GitHub MCP Server?

Connect the server in your client's MCP settings, restart the client, and ask in plain language: the agent chooses the tool. Because the full tool set is large, the README advises turning on only the toolsets you need (local: --toolsets or GITHUB_TOOLSETS; remote: X-MCP-Toolsets header or a toolset URL) and offers a read-only mode for first runs.

Key features of GitHub MCP Server

✓We counted at c59e8c1: 141 tool definitions in pkg/github/__toolsnaps__, of which 61 are marked readOnlyHint and 13 destructiveHint (for example delete_repository, delete_file, actions_run_trigger)
✓We counted: the README lists 22 toolsets (context, repos, issues, pull_requests, actions, code_security, secret_protection, dependabot, discussions, gists, projects, orgs and others); the default set is 5 - context, repos, issues, pull_requests, users
✓Two ways to run it, per the README: remote (hosted by GitHub, OAuth or PAT) or local (Docker image, OAuth login on first use or GITHUB_PERSONAL_ACCESS_TOKEN, which takes precedence)
✓Safety switches documented in the README: --read-only / GITHUB_READ_ONLY=1, and --lockdown-mode / GITHUB_LOCKDOWN_MODE=1, which hides issue and PR content from authors without push access to a public repo (described as a best-effort filter against prompt injection, not a security boundary)
✓With a classic PAT (ghp_) the server hides tools your token's scopes cannot use; fine-grained PATs and GitHub App tokens show all tools and let the API enforce permissions (docs/scope-filtering.md)
✓GitHub Enterprise Server and ghe.com data-residency hosts are supported through --gh-host / GITHUB_HOST

When to use GitHub MCP Server

1Letting an agent triage open issues and summarise a pull request without leaving the editor
2Asking why a CI run failed by reading Actions workflow runs and logs
3Reviewing Dependabot and code-scanning alerts across a repository
4Read-only exploration of someone else's repository (search code, read files, list commits)

Installation & Setup Guide

Agent Rules / Prompt Setup

Follow these steps (taken from the project's own docs) to configure GitHub MCP Server in your development environment.

Step 1: Claude Code (remote server, PAT)claude

claude mcp add-json github '{"type":"http","url":"https://api.githubcopilot.com/mcp","headers":{"Authorization":"Bearer YOUR_GITHUB_PAT"}}'

From docs/installation-guides/install-claude.md. The guide notes add-json can return 'Invalid input' on Windows and then gives a legacy 'claude mcp add --transport http' form. It also has a Docker variant with OAuth.

Step 2: Cursorcursor

The repo ships docs/installation-guides/install-cursor.md; follow it. We do not copy its config here.

Step 3: Gemini CLIgemini

The repo ships gemini-extension.json (HTTP endpoint https://api.githubcopilot.com/mcp/ with an Authorization: Bearer $GITHUB_MCP_PAT header) and docs/installation-guides/install-gemini-cli.md.

Usage Example & Verification

Prompt / Request Example

1. (our example, read-only)
List the 10 most recent open issues in owner/repo, group them by label, and tell me which look like duplicates. Do not comment or edit anything.
-> Uses the issues toolset (list/search/read); works with --read-only.

2. (our example)
Summarise pull request #42 in owner/repo: what files changed, what the review comments ask for, and whether the checks passed.
-> Uses pull_request_read and Actions/status tools; no write access needed.

3. (our example, writes)
Create an issue in owner/repo titled 'Document the Docker install' with a short description, label it 'documentation', and show me the issue URL.
-> This writes to your account; try it on a test repository first.

Security Review

Static review

Reviewed Date

2026-10-15

Audited Ref / Commit

c59e8c199efbf14467211861de44afaeeb6873e3

Reviewer

antigravityskills.org (static review)

Official GitHub server; acts in your GitHub account with your token; read-only mode available; destructive tools exist.

Full review: scope, findings, risks

Audit Scope:README.md (install, authentication, toolsets, read-only and lockdown sections), docs/installation-guides/install-antigravity.md, docs/remote-server.md, docs/scope-filtering.md, docs/policies-and-governance.md, server.json, gemini-extension.json, agent-plugin/mcp.json, go.mod, Dockerfile (header), SECURITY.md, LICENSE, and the 141 tool snapshots under pkg/github/__toolsnaps__, all at commit c59e8c1 (2026-10-13). Static review only: we did not build the Go code, run the Docker image or connect it to Antigravity, and we did not audit all 75 Go source files in pkg/github line by line.

Key Findings:Official GitHub project, MIT licensed. Authenticates with OAuth or a Personal Access Token and calls the GitHub API (api.github.com, or your Enterprise host). The server has write and destructive tools (13 of 141 flagged destructiveHint) and ships read-only and lockdown switches. A comment in pkg/github/fields_telemetry.go says the local server uses a no-op metrics sink while hosted deployments inject a real one. The docs describe a startup HEAD request to the GitHub API to read a classic PAT's scopes.

Identified Operational Risks & Permissions:Medium, driven by the permissions you grant, not by hidden behaviour. A broad token lets an agent create, edit and delete things in your repositories, and public issue text can attempt prompt injection. Use read-only mode, a fine-grained token and a test repository first.

We read the documentation and manifests listed under review scope and counted the tool snapshots. The server needs credentials (PAT or OAuth) and everything it does is an authenticated GitHub API call. Destructive tools include delete_repository, delete_file and actions_run_trigger. The README's token guidance is to give the minimum scopes and keep tokens out of version control. This is a read of the repo's documentation and metadata, not a penetration test.

Operational Notes & Known Limitations

Known Limitations

•The agent acts with your GitHub permissions. A token with repo scope can write to every private repository you can; the README tells you to grant only the permissions you are comfortable giving the agent
•Some tools are destructive (delete_repository, delete_file); there is no confirmation beyond what your client asks for, so use --read-only until you trust the setup
•We counted 141 tool definitions in total. The Antigravity guide in the repo recommends keeping enabled tools under 50, so narrow the toolsets instead of enabling everything
•Content in public issues and pull requests is written by strangers and can try to steer the agent (prompt injection); lockdown mode reduces this but is not a guarantee
•The repo's own Antigravity guide notes that installing from the Antigravity MCP Store has known issues (often Docker errors) and recommends the manual remote configuration

Platform Compatibility

Claude CodeCursorGemini CLIAntigravity

Frequently Asked Questions

Is the GitHub MCP Server safe to use?

It is GitHub's own open-source project (MIT) and its code only talks to GitHub's API. The risk is the access you give it: it acts as you, and 13 of its 141 tool definitions are marked destructive. Start with --read-only or X-MCP-Readonly and a fine-grained token.

How do I install it in Antigravity?

Add a github entry with serverUrl https://api.githubcopilot.com/mcp/ and an Authorization Bearer header to Antigravity's mcp_config.json, restart, and check the MCP Servers panel. Antigravity needs serverUrl, not url.

Remote or local - which should I pick?

The README calls the remote server the easiest way to get running. Pick local Docker if your client cannot use remote MCP servers or you need your own OAuth app (for example on GitHub Enterprise Server).

Does it need a Personal Access Token?

Not always. The local image can log in with OAuth on first use and keeps the token in memory; a PAT in GITHUB_PERSONAL_ACCESS_TOKEN takes precedence if set.

Why are there so many tools?

We counted 141 tool definitions across 22 toolsets. Only 5 toolsets are on by default; use --toolsets or --tools to keep the list short, especially in Antigravity, where the repo recommends under 50.

Supported Platforms

antigravityclaudecursorgemini

View Source on GitHub

Keep exploring this topic

Browse the full Antigravity skills directory for more source-linked skills with install steps and static safety reviews.

More devops skills #github #mcp #devops #pull-requests Use cases

Related Skills

🚀

Vercel Specialist

@sickn33

Community skill with patterns and a list of known pitfalls for deploying Next.js apps to Vercel: environment variables, edge vs serverless, previews, domains and caching.

Static reviewinstructions onlyoffline

vercelnextjs

⚡

Filesystem MCP Server

@modelcontextprotocol

Official MCP reference server for reading, writing, editing, moving and searching files inside directories you allow.

Static reviewwrites filesoffline

mcpfilesystem

🛡️

Secrets Management

@sickn33

Community skill with a short procedure for handling CI/CD secrets safely: Vault, cloud secret managers, GitHub Actions, workload identity and rotation.

Static review

secretsci-cd