GitHub MCP server in Claude Code: setup, toolsets, and when not to

Sixty-second setup

claude mcp add --transport http github https://api.githubcopilot.com/mcp/ \
  --header "Authorization: Bearer YOUR_GITHUB_PAT"

claude mcp list

Review PR #456 and suggest improvements
Show me the failing job logs for the latest run on main
Create an issue for the bug we just found, and link the PR

Scope it with toolset endpoints

This is the feature that makes the GitHub server unusually well behaved, and almost nobody uses it. The base URL exposes the default toolsets. Appending a path narrows the server to one, which cuts the tool surface, cuts the context cost, and cuts what a confused agent can reach.

# code review: PRs, read-only
claude mcp add --transport http gh-pr \
  https://api.githubcopilot.com/mcp/x/pull_requests/readonly \
  --header "Authorization: Bearer $GITHUB_PAT"

# CI triage: Actions, read-only
claude mcp add --transport http gh-ci \
  https://api.githubcopilot.com/mcp/x/actions/readonly \
  --header "Authorization: Bearer $GITHUB_PAT"

Remote or local

claude mcp add github-local \
  --env GITHUB_PERSONAL_ACCESS_TOKEN=YOUR_PAT \
  --env GITHUB_TOOLSETS=repos,issues,pull_requests \
  --env GITHUB_READ_ONLY=true \
  -- docker run -i --rm \
     -e GITHUB_PERSONAL_ACCESS_TOKEN -e GITHUB_TOOLSETS -e GITHUB_READ_ONLY \
     ghcr.io/github/github-mcp-server

Default toolsets on the local server are context, repos, issues, pull_requests, and users. Set GITHUB_TOOLSETS="all" to enable everything, which you should not do without a reason.

Three workflows that justify it

Adding the server and then using it the way you used gh is how people conclude MCP is overrated. The payoff is in multi-step work where the agent holds the whole picture, not in single lookups.

Reviewing a pull request with its history

Read PR #412, including every review comment and the diff.
Then check whether the concerns raised in review #3 on PR #388 apply here too,
and tell me which ones are unresolved.

That is four or five calls the agent sequences itself. Doing it with gh means parsing JSON in Bash and losing comment position, which is the thing that makes a review thread legible in the first place.

Triaging a failing build

The latest Actions run on main failed. Get the failing job logs, find the first
real error rather than the last line, then check whether the commit that
introduced it touched anything the test covers.

The Actions toolset is the underrated one. Log output is enormous, and having the agent fetch and reduce it beats scrolling a web UI. Watch the size: Claude Code truncates any single MCP result over 25,000 tokens by default, so ask for a job rather than a run.

Closing the loop from issue to PR

Read issue #219. Implement it on a branch, open a PR that closes it, and
summarise in the PR body what you changed and what you deliberately did not.

The honest comparison: gh CLI

Claude Code can already run gh through Bash, on a machine where it is probably already authenticated. Before adding the MCP server, it is worth knowing what you are buying, because for a meaningful set of tasks the answer is "nothing".

The pragmatic setup for most people: keep gh for the quick, imperative things, and add a read-only GitHub MCP server for the structured reading an agent does during review. They coexist fine.

Locking it down with permission rules

A read-only endpoint is the strong boundary. Permission rules are the finer one, and they are how you keep write access for the two tools you want while refusing the rest. Every MCP tool is addressable by name, in the form mcp__<server>__<tool>, where the server segment is the name you gave it in claude mcp add.

{
  "permissions": {
    "allow": [
      "mcp__github__get_*",
      "mcp__github__list_*",
      "mcp__github__search_*"
    ],
    "ask": [
      "mcp__github__create_pull_request",
      "mcp__github__merge_pull_request"
    ],
    "deny": [
      "mcp__github__delete_*"
    ]
  }
}

Hook matchers use the same names, so a PreToolUse hook on mcp__github__.* can log or block writes centrally. If the server arrived from a plugin rather than claude mcp add, the callable name is longer, mcp__plugin_<plugin>_<server>__<tool>, and a matcher written against the bare server key never fires. That mismatch is a genuinely hard bug to see, because the hook is present, valid, and silent.

When it will not connect

curl -sS -H "Authorization: Bearer $GITHUB_PAT" \
  https://api.github.com/user | jq .login

claude mcp get github
claude mcp remove github && claude mcp add --transport http github \
  https://api.githubcopilot.com/mcp/x/all/readonly \
  --header "Authorization: Bearer $GITHUB_PAT"

Questions people ask

Keep reading