GitHub (Official)
GitHub's own MCP server. Repos, issues, PRs, code search, workflows. The replacement for the now-archived Anthropic GitHub MCP.
Delv Safety Grade: A
Score 84/100 · assessed 2026-04-22
GitHub's official MCP server is maintained by a tier-one vendor with excellent transparency and documentation. The maintainer score is near-perfect given GitHub's resources and track record. Permissions are moderately scoped: the server can read and write to repositories, issues, and pull requests, plus trigger workflows, which grants substantial control over your GitHub account. The Docker distribution via GitHub Container Registry is solid, though not quite as battle-tested as npm or PyPI for dependency pinning. Transparency is excellent with full open-source code, comprehensive docs, and active issue tracking. No known security incidents. The main risk is the breadth of write permissions: a compromised token or malicious prompt could create PRs, close issues, or trigger workflows across all repos the token can access. Suitable for professional use with a scoped personal access token.
Lethal Trifecta (prompt-injection exposure)
TRIFECTA RISKReads private repos, consumes attacker-controlled content via issues and PR bodies, can write to repos and call external APIs. Classic trifecta surface — treat any issue body as potentially hostile input.
Green flags
- Official GitHub product with institutional backing and maintenance
- Fully open source with comprehensive documentation and changelog
- Replaces archived Anthropic version, showing active vendor commitment
- Docker distribution provides some isolation from host system
- Active issue tracker and responsive maintenance
Red flags
- Requires PAT with broad repo write access across all accessible repositories
- Can trigger GitHub Actions workflows, potentially executing arbitrary code
- Docker-only install lacks traditional package manager verification
- No granular permission scoping within the server itself
Permissions requested
Install
docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN=<token> ghcr.io/github/github-mcp-server
GITHUB_PERSONAL_ACCESS_TOKENReview
Install this if you work across multiple repos or do heavy issue triage. The Docker dependency is a minor hassle, but the reliability and official backing make it the default choice for GitHub operations in AI hosts. Skip it if you only touch GitHub occasionally.
Good at
- Official GitHub support means it stays current with API changes and new features.
- Code search across repos is fast and returns actionable file paths and line numbers.
- Docker install avoids dependency hell and works the same on macOS, Linux, and Windows.
- Read operations like fetching diffs or commit history are genuinely faster than clicking through the browser.
- Works reliably with Claude Desktop and other popular hosts like Cursor and Zed.
Watch out
- Requires Docker running at all times, which adds memory overhead and startup friction.
- Token scope errors are vague and take trial and error to resolve.
- Write operations like opening PRs feel slightly slower than read-heavy tasks.
- Hosts beyond Claude Desktop need manual config file edits, no GUI setup.
- Overkill if you only interact with GitHub occasionally or work in a single repo.
Use cases
- Opening PRs from a Claude conversation
- Triaging issues across repos
- Generating release notes from commit history
- Reviewing diffs without leaving the chat
Getting started
Works with
Similar MCPs
- GitHubFull GitHub API access - manage repos, issues, PRs, and code search. One of the most useful MCPs for any developer workflow.
- GrafanaGrafana Labs' official MCP. Read dashboards, datasources, alerts, and run Loki/Prometheus queries from inside your agent.
- SentryPull live errors, issues, and replays from Sentry into Claude. Great for debugging sessions where the model can see what actually broke in prod.
- MCP CLIInteractive CLI inspector for MCP servers supporting OAuth, tool calls, resource reads, and prompt runs.