library · github

GitHub, pinned to your organization.

GitHub's MCP server covers repositories, files, issues, pull requests, actions, discussions and security alerts. The rule most teams want is short: this organization only, read anything, open a pull request, never push to main directly. That is one preset.

"presets": {
  "proposer": {
    "tools": [
      "get_file_contents",
      "issue_read",
      "create_pull_request"
    ],
    "pinnedKeys": { "owner": ["acme"] }
  }
}

Example, not real data. Tool names from the server's README.

What the agent can reach.

entryio.github.github/github-mcp-server, at api.githubcopilot.com/mcp, OAuth per person

toolsetsrepos, issues, pull requests, actions, discussions, gists, notifications, projects, orgs, users, code security, secret protection, dependabot

examplesget_file_contents, issue_read, issue_write, create_pull_request, create_or_update_file, delete_file

read-only modeGitHub serves a read-only variant of the same server at a separate URL

From the server's README as of 2026-09-02. The catalog shows what it publishes when it connects.

What changes when it runs through the gateway.

A pinned owner is injected into every call and recorded as injected, so an agent cannot wander into another organization by naming it. Tools left out of the preset are not present in the catalog; an agent does not see delete_file and cannot ask for it. Every write needs a goal in force and passes the evidence check, and a pull request opened through the gateway is opened by the person whose token ran the agent.

A measurable goal is easy here: open pull requests older than a week, or issues without an assignee, read by whichever GitHub read tool returns the count.

One caveat.

Which GitHub tools count as reads is decided by the server's own annotations; a library reference cannot add names. If you need a GitHub that is read-only by construction, add GitHub's read-only URL as a custom server and list its read tools there.

Next in the library.

Sentry → sign in