GitHub MCP Server: install, 92 tools and safe setup

• Searches code across GitHub to find where something is used

  Searches code across GitHub with GitHub's code search syntax.

  Try: “Find where parseToken is defined in the acme org.”

  Read · search_code

• Reads a file or lists a folder in a repo, at any branch, tag or commit

  Reads a file or lists a directory at a branch, tag or commit.

  Try: “Open src/auth.ts in acme/web and explain the login flow.”

  Read · get_file_contents

• Shows the full file and folder layout of a repo

  Returns a repo's file tree at a ref, optionally recursive and filtered by path.

  Try: “Show the full file tree under src/ in acme/web.”

  Read · get_repository_tree

• Finds repos by name, topic, language or stars

  Searches repositories by name, topic, language, stars and more.

  Try: “Find Python repos about MCP servers with more than 1,000 stars.”

  Read · search_repositories

• Lists a repo's issues, filtered by state, label or date

  Lists issues in a repo with filters for state, labels, date and custom fields.

  Try: “List open bugs in acme/web updated this week.”

  Read · list_issues

• Reads an issue with its comments, labels and sub-issues

  Reads one issue: details, comments, sub-issues, parent issue or labels.

  Try: “Summarize issue #128 in acme/web and its comments.”

  Read · issue_read

• Searches issues across repos in plain words

  Searches issues across repositories in natural language.

  Try: “Find open issues about rate limits in the acme org.”

  Read · search_issues

• Opens a new issue or edits one: title, labels, assignees, status

  Creates a new issue or updates one: title, body, labels, assignees, milestone, state, type and fields.

  Try: “Open an issue in acme/web titled 'Login times out on Safari' and label it bug.”

  Write · issue_write

• Posts a comment or emoji reaction on an issue or pull request

  Posts a comment, or an emoji reaction, on an issue or pull request.

  Try: “Comment on issue #42 in acme/web that the fix ships in v1.5.”

  Write · add_issue_comment

• Edits a comment you posted on an issue or pull request

  Edits an existing comment on an issue or pull request.

  Try: “Edit my last comment on issue #42 to fix the version number.”

  Write · update_issue_comment

• Adds, removes or reorders sub-issues under a parent issue

  Adds, removes or reorders sub-issues under a parent issue.

  Try: “Make issue #57 a sub-issue of #40 in acme/web.”

  Write · sub_issue_write

• Lists a repo's pull requests, filtered by state or branch

  Lists pull requests in a repo, filterable by state, base and head branch.

  Try: “List open pull requests in acme/web.”

  Read · list_pull_requests

• Reads a pull request: changes, files, commits, reviews and checks

  Reads one pull request: details, diff, status, changed files, commits, review threads, reviews, comments or check runs.

  Try: “Show me the diff and failing checks for PR #77 in acme/web.”

  Read · pull_request_read

• Searches pull requests across repos

  Searches pull requests across repositories.

  Try: “Find my open PRs across all repos that are waiting for review.”

  Read · search_pull_requests

• Opens a pull request from one branch into another

  Opens a new pull request from one branch into another.

  Try: “Open a PR from fix/login-timeout into main in acme/web.”

  Write · create_pull_request

• Edits a pull request: title, description, status, draft or reviewers

  Edits a pull request: title, body, state, base branch, draft status or reviewers.

  Try: “Change the title of PR #77 and request a review from @sam.”

  Write · update_pull_request

• Creates, submits or deletes a review and resolves review threads

  Creates, submits or deletes a review on a pull request, and resolves or unresolves review threads.

  Try: “Approve PR #77 in acme/web with the comment 'Looks good'.”

  Write · pull_request_review_write

• Adds a line comment to your review before you submit it

  Adds a line comment to your own pending (not yet submitted) review on a pull request.

  Try: “In my pending review of PR #77, comment on line 30 of api.go that this needs a nil check.”

  Write · add_comment_to_pending_review

• Replies to a review comment on a pull request

  Replies to an existing review comment on a pull request.

  Try: “Reply to the reviewer's comment on PR #77 that I moved the check into a helper.”

  Write · add_reply_to_pull_request_comment

• Brings a pull request branch up to date with its base

  Brings a pull request branch up to date with its base branch.

  Try: “Update PR #77's branch with the latest main.”

  Write · update_pull_request_branch

• Merges a pull request (merge, squash or rebase)

  Merges a pull request with merge, squash or rebase, optionally only if the head commit matches.

  Try: “Squash-merge PR #77 in acme/web.”

  Write · merge_pull_request

• Reads build logs, including every failed job in a run

  Gets logs for one job, or for every failed job in a run, optionally just the last lines.

  Try: “Why did the latest CI run fail in acme/web? Show the failing job logs.”

  Read · get_job_logs

• Lists your workflows, their runs, jobs and saved build files

  Lists workflows, workflow runs, jobs in a run, or artifacts of a run.

  Try: “List the last failed runs of ci.yml in acme/web.”

  Read · actions_list

• Shows one workflow, run, job or build file in detail

  Gets one Actions resource: a workflow, a run, its usage, a job, a log download URL or an artifact.

  Try: “Show details of workflow run 123456 in acme/web.”

  Read · actions_get

• Starts, re-runs or cancels a workflow, or deletes a run's logs

  Starts a workflow, re-runs a run or only its failed jobs, cancels a run, or deletes a run's logs.

  Try: “Run the deploy.yml workflow on main in acme/web.”

  Delete · actions_run_trigger

• Lists recent commits on a branch, newest first

  Lists commits on a branch, newest first.

  Try: “Show the last 10 commits on main in acme/web.”

  Read · list_commits

• Shows one commit: message, author, changed files and diff

  Shows one commit: message, author, changed files and diff.

  Try: “Show me what commit a1b2c3d changed in acme/web.”

  Read · get_commit

• Searches commit messages and details

  Searches commit messages and metadata.

  Try: “Find commits mentioning CVE-2025 in acme/web.”

  Read · search_commits

• Saves one file to a branch as a commit

  Writes one file to a branch as a commit. Changing a workflow file also needs the workflow scope.

  Try: “Update README.md on the docs branch of acme/web to add an install section.”

  Write · create_or_update_file

• Commits several files to a branch in one go

  Commits several files to a branch in one push. Workflow files also need the workflow scope.

  Try: “Push these three new test files to the add-tests branch in acme/web.”

  Write · push_files

• Deletes one file from a branch as a commit

  Deletes one file from a branch as a commit.

  Try: “Delete old-config.yml from the cleanup branch in acme/web.”

  Delete · delete_file

• Creates a new branch from the default branch or another one

  Creates a new branch in a repository, from the default branch or another one.

  Try: “Create a branch fix/login-timeout from main in acme/web.”

  Write · create_branch

• Lists a repo's branches

  Lists the branches of a repository.

  Try: “List all branches in acme/web.”

  Read · list_branches

• Lists your GitHub notifications, filtered by repo or date

  Lists your notifications, with filters for repo, date and participation.

  Try: “What GitHub notifications need my attention today?”

  Read · list_notifications

• Reads one notification

  Reads one notification thread.

  Try: “What is my latest notification about?”

  Read · get_notification_details

• Marks one notification as read or done

  Marks one notification thread as read or done.

  Try: “Mark the notification about PR #77 as done.”

  Write · dismiss_notification

• Marks all your notifications as read, for one repo or all

  Marks all notifications as read, optionally for one repo.

  Try: “Mark all my notifications in acme/web as read.”

  Write · mark_all_notifications_read

• Watches or mutes one notification thread

  Ignores, watches or removes your subscription to one notification thread.

  Try: “Stop notifying me about issue #42.”

  Write · manage_notification_subscription

• Watches or mutes a whole repo

  Ignores, watches or removes your subscription to a whole repository.

  Try: “Watch acme/web for all activity.”

  Write · manage_repository_notification_subscription

• Hands an issue to Copilot, which works on it and opens a pull request

  Assigns Copilot coding agent to an issue so it works on it and opens a pull request.

  Try: “Assign Copilot to issue #88 in acme/web.”

  Runs code · assign_copilot_to_issue

• Hands an issue to Copilot with a reason, or suggests it for you to approve

  Assigns Copilot to an issue with a stated rationale and confidence, or records it as a suggestion to approve later.

  Try: “Suggest assigning Copilot to issue #88 and explain why.”

  Runs code · assign_copilot_to_issue_with_intent

• Gives Copilot a task to do and open a pull request (hosted version only)

  Hands a task to Copilot coding agent, which works on it and opens a pull request. Hosted server only.

  Try: “Ask Copilot to add input validation to the signup form in acme/web and open a PR.”

  Runs code · create_pull_request_with_copilot

• Asks Copilot to review a pull request

  Asks Copilot to review a pull request.

  Try: “Request a Copilot review on PR #77.”

  Write · request_copilot_review

• Lists a repo's releases

  Lists the releases of a repository.

  Try: “List the last five releases of acme/web.”

  Read · list_releases

• Shows a repo's newest release

  Returns the newest published release of a repo.

  Try: “What is the latest release of github/github-mcp-server?”

  Read · get_latest_release

• Shows the release for a given tag

  Returns the release attached to a given tag.

  Try: “Show the release notes for v2.0.0 of acme/web.”

  Read · get_release_by_tag

• Lists a repo's tags

  Lists the tags of a repository.

  Try: “List the tags in acme/web.”

  Read · list_tags

• Shows details of one tag

  Returns details of one Git tag.

  Try: “What commit does tag v1.4.0 point to in acme/web?”

  Read · get_tag

• Creates a new repo under your account or an organization

  Creates a new repository under your account or an organization.

  Try: “Create a private repo called notes-api in my account.”

  Write · create_repository

• Copies (forks) a repo to your account or an organization

  Forks a repository to your account or an organization.

  Try: “Fork vercel/next.js to my account.”

  Write · fork_repository

• Deletes a whole repo (asks you to confirm first)

  Deletes a whole repository. Needs the delete_repo scope and goes through a confirmation step first.

  Try: “Delete my test repo scratch-2024.”

  Delete · delete_repository

• Lists who has access to a repo

  Lists people with access to a repo, filterable to outside or direct collaborators.

  Try: “Who are the outside collaborators on acme/web?”

  Read · list_repository_collaborators

• Lists all labels in a repo

  Lists all labels in a repository.

  Try: “List all labels in acme/web.”

  Read · list_label

• Shows one label with its color and description

  Returns one label from a repo, with its color and description.

  Try: “What does the needs-triage label in acme/web mean?”

  Read · get_label

• Creates, edits or deletes a label in a repo

  Creates, updates or deletes a label in a repository.

  Try: “Create a label good-first-issue in acme/web, color 7057ff.”

  Delete · label_write

• Lists the issue types a repo uses, like Bug or Feature

  Lists the issue types (such as Bug or Feature) available for a repo or organization.

  Try: “Which issue types can I use in acme/web?”

  Read · list_issue_types

• Lists the custom issue fields set up for a repo or organization

  Lists custom issue fields defined for a repo or organization.

  Try: “What custom issue fields does the acme org use?”

  Read · list_issue_fields

• Shows a repo's branch rules and how recent pushes were checked

  Reads rulesets, the rules for a branch, and rule-suite evaluations of pushes.

  Try: “Which rules apply to the main branch of acme/web?”

  Read · repository_ruleset_read

• Creates branch rules, like requiring pull requests on main

  Creates a ruleset at repo, org or enterprise level (for example require PRs on main).

  Try: “Create a ruleset on acme/web that blocks force pushes to main.”

  Write · create_repository_ruleset

• Reads custom properties set on a repo or organization

  Reads custom property values on a repo, or property definitions for an org or enterprise.

  Try: “What custom properties are set on acme/web?”

  Read · custom_properties_read

• Sets custom properties on a repo or organization

  Sets custom property values on a repo, or defines properties for an org or enterprise.

  Try: “Set the team property on acme/web to platform.”

  Write · custom_properties_write

• Lists code scanning alerts, filtered by state or severity

  Lists code scanning alerts, filterable by state, severity, tool and ref.

  Try: “List open high-severity code scanning alerts in acme/web.”

  Read · list_code_scanning_alerts

• Reads one code scanning alert

  Reads one code scanning alert.

  Try: “Explain code scanning alert #5 in acme/web and suggest a fix.”

  Read · get_code_scanning_alert

• Lists alerts about vulnerable dependencies, by state or severity

  Lists Dependabot alerts, filterable by state and severity.

  Try: “List open critical Dependabot alerts in acme/web.”

  Read · list_dependabot_alerts

• Reads one vulnerable dependency alert

  Reads one Dependabot alert.

  Try: “Explain Dependabot alert #3 in acme/web.”

  Read · get_dependabot_alert

• Lists alerts about passwords or keys leaked in a repo

  Lists secret scanning alerts for a repo.

  Try: “Are there open secret scanning alerts in acme/web?”

  Read · list_secret_scanning_alerts

• Reads one leaked secret alert

  Reads one secret scanning alert.

  Try: “Explain secret scanning alert #2 in acme/web.”

  Read · get_secret_scanning_alert

• Reads one code quality finding

  Reads one GitHub Code Quality finding.

  Try: “Explain code quality finding #12 in acme/web.”

  Read · get_code_quality_finding

• Lists security advisories published or drafted for a repo

  Lists security advisories published or drafted for one repo.

  Try: “List security advisories for acme/web.”

  Read · list_repository_security_advisories

• Lists security advisories across an organization's repos

  Lists repository security advisories across an organization.

  Try: “List draft security advisories across the acme org.”

  Read · list_org_repository_security_advisories

• Searches GitHub's public database of known vulnerabilities

  Searches the GitHub Advisory Database by ecosystem, package, severity and more.

  Try: “List critical npm advisories published this month.”

  Read · list_global_security_advisories

• Reads one entry from GitHub's database of known vulnerabilities

  Reads one advisory from the GitHub Advisory Database.

  Try: “Explain GHSA-xxxx-xxxx-xxxx in plain terms.”

  Read · get_global_security_advisory

• Lists project boards, their items, fields and views

  Lists projects, fields, items, views or status updates, with GitHub's project filter syntax.

  Try: “List items in acme's project 4 that are In Progress.”

  Read · projects_list

• Shows one project board, item, field, view or status update

  Gets one Projects resource: a project, a field, an item with chosen fields, a status update or a view.

  Try: “Show the Status and Priority of item 123 in project 4 of acme.”

  Read · projects_get

• Manages project boards: add, edit or delete items, post status updates

  Manages Projects: creates projects and views, adds, updates or deletes items, posts status updates and creates iteration fields.

  Try: “Add issue #88 from acme/web to project 4 and set Status to Todo.”

  Delete · projects_write

• Lists discussions in a repo or organization

  Lists discussions in a repo or organization.

  Try: “List the latest Q&A discussions in acme/web.”

  Read · list_discussions

• Reads one discussion

  Reads one discussion.

  Try: “Summarize discussion #9 in acme/web.”

  Read · get_discussion

• Reads a discussion's comments and replies

  Reads the comments of a discussion, optionally with replies.

  Try: “Show the comments on discussion #9.”

  Read · get_discussion_comments

• Lists discussion categories in a repo or organization

  Lists the discussion categories of a repo or organization.

  Try: “What discussion categories does acme/web have?”

  Read · list_discussion_categories

• Adds, edits or deletes discussion comments and marks the answer

  Adds, replies to, edits or deletes discussion comments, and marks or unmarks an answer.

  Try: “Reply to the top comment in discussion #9 with the workaround.”

  Delete · discussion_comment_write

• Lists gists for you or another user

  Lists gists for you or another user.

  Try: “List my gists from the last month.”

  Read · list_gists

• Reads one gist

  Reads one gist.

  Try: “Show the files in gist <gist-id>.”

  Read · get_gist

• Creates a one-file gist, public or secret

  Creates a single-file gist, public or secret.

  Try: “Save this snippet as a secret gist called retry.py.”

  Write · create_gist

• Edits a file in one of your gists

  Updates a file in an existing gist.

  Try: “Update retry.py in my gist with this new version.”

  Write · update_gist

• Finds GitHub users by name, location or followers

  Searches GitHub users by name, location, followers and more.

  Try: “Find GitHub users in Berlin with more than 500 followers.”

  Read · search_users

• Finds GitHub organizations

  Searches GitHub organizations.

  Try: “Find organizations in California working on databases.”

  Read · search_orgs

• Lists the teams you or another user belong to

  Lists the teams a user belongs to, yourself by default.

  Try: “Which GitHub teams am I on?”

  Read · get_teams

• Lists the members of a team in an organization

  Lists the members of one team in an organization.

  Try: “Who is on the platform team in the acme org?”

  Read · get_team_members

• Lists repos starred by you or another user

  Lists repositories starred by you or another user.

  Try: “What repos have I starred recently?”

  Read · list_starred_repositories

• Stars a repo

  Stars a repository.

  Try: “Star github/github-mcp-server.”

  Write · star_repository

• Removes your star from a repo

  Removes your star from a repository.

  Try: “Unstar acme/old-project.”

  Write · unstar_repository

• Lists the Copilot Spaces you can open (hosted version only)

  Lists the Copilot Spaces you can access. Hosted server only.

  Try: “Which Copilot Spaces can I use?”

  Read · list_copilot_spaces

• Reads a Copilot Space and its context (hosted version only)

  Reads a Copilot Space and its context. Hosted server only.

  Try: “Load the onboarding Copilot Space owned by acme.”

  Read · get_copilot_space

• Searches GitHub's help docs to answer product questions (hosted version only)

  Searches GitHub's documentation to answer product and support questions. Hosted server only.

  Try: “How do I require signed commits on a branch?”

  Read · github_support_docs_search

• Used by the assistant behind the scenes

  Looks up which GitHub account you are signed in as

  Returns the profile of the account the token or login belongs to. Assistants call it first to learn who "me" is.

  Try: “Who am I logged in as on GitHub?”

  Read · get_me

• Fetches choices like labels, assignees or branches for a picker

  Fetches picker data for a repo, such as labels, assignees, milestones, branches, issue fields or reviewers, so the client can show choices.

  Try: “What labels and milestones exist in acme/web?”

  Read · ui_get

Watch out for

• It can change and delete code, not just read it

  Out of the box it can push files, merge pull requests and create repos, and a delete-repository tool exists. Start in read-only mode, or switch on only the tools you need. github.com

• Text in public issues can trick it into leaking code

  Researchers showed a planted public issue steering an assistant into copying private repo data into a public pull request. Give it access only to the repos the job needs, and turn on lockdown mode. invariantlabs.ai

• Lockdown mode helps, but it is not a guarantee

  Lockdown mode hides public-repo content written by people who can't push to that repo. GitHub calls it a best-effort filter, not a security boundary. github.com

• Older-style tokens hide tools they can't use

  With a classic token (starting ghp_), it hides tools your token has no permission for. Fine-grained tokens don't hide them, but GitHub still blocks anything the token can't do. github.com

• Your org admins can block or allow it

  Admins can block it in Copilot editors and control which apps and tokens get access. Its actions show in the audit log as normal GitHub activity, with no separate log for it. github.com

Security advisories

In their words