GitHub MCP server. What it holds.
The server authenticates to another system with a key, token or connection string. Its reach is whatever that credential reaches, inherited by every agent allowed to call it. Published by GitHub (official).
The record
Taken from the official documentation linked at the bottom.
| Field | Value |
|---|---|
| Publisher | GitHub (official) |
| Authentication | OAuth, a personal access token, or GitHub App authentication. Available as a remote server hosted by GitHub and as a local server via Docker or binary. |
| What it holds | A GitHub identity. For the local server the token sits in the GITHUB_PERSONAL_ACCESS_TOKEN environment variable. |
| What that reaches | Whatever that token is scoped to. The documentation states that most tools require the repo scope and that security-focused operations need security_events. A token with repo reaches private repositories, their CI configuration and the secrets referenced there. |
| Risk class | Holds a credential The server authenticates to another system with a key, token or connection string. Its reach is whatever that credential reaches, inherited by every agent allowed to call it. |
Why it matters
The server exposes 24 named toolsets, from repos and pull_requests to actions, secret_protection and code_security. GitHub recommends enabling only the toolsets and permissions you are comfortable granting. That recommendation is the whole security model: the server does not narrow the token, the token narrows the server.
Not whether the server is trustworthy. What it holds, and what that reaches.
What to check
Which scopes the token carries, whether it is a personal token tied to an individual, and whether the same token is used by more than one agent.
The same questions apply to any server in this database, which is why the MCP server security page is the general version of this page.
Holds a credential
Where this comes from.
Every field above is taken from the official documentation. Where it does not say, this page does not either.
Questions, answered.
The two questions this record answers.
What credential does the GitHub MCP server hold?
A GitHub identity. For the local server the token sits in the GITHUB_PERSONAL_ACCESS_TOKEN environment variable.
What can it reach?
Whatever that token is scoped to. The documentation states that most tools require the repo scope and that security-focused operations need security_events. A token with repo reaches private repositories, their CI configuration and the secrets referenced there.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.