MCPG Config
TemplatesHow it works
All templates

GitHub Repositories

Developer tools

Set up this templateGitHub API docs

Gives an agent the parts of GitHub it usually needs — issues, pull requests and Actions runs — scoped by a token it never sees, on repositories it cannot widen beyond what that token was granted.

What you get

  • gh.issues.list — issues on a repository, filtered by state.
  • gh.issue.create — file a new issue, with labels.
  • gh.pr.list — open, closed or all pull requests.
  • gh.actions.runs — recent workflow runs, optionally for one branch.
  • github://{owner}/{repo}/issues/{number} — a single issue as an MCP resource.

What you need

  • GitHub access token — a fine-grained PAT or a GitHub App installation token. Grant it exactly the repositories these tools should reach: the token is the entire boundary, because owner and repo are caller arguments and a caller can name any repository it likes.
  • JWKS endpoint — the host where your identity provider publishes its signing keys, without a scheme.
  • Token audience — the aud claim your callers' tokens carry.
  • GitHub API host — optional, and only for GitHub Enterprise Server.

How it works

Every binding sets Authorization itself. The caller supplies owner and repo; it has no way to supply a token, so the reachable set is whatever the configured token can see and nothing more. That is why the fine-grained token matters more here than in most templates — a classic PAT with repo scope turns "list issues" into "list issues anywhere I have access".

X-GitHub-Api-Version is pinned on every request, so a REST API change lands on the day you edit this config rather than the day GitHub ships it.

On a managed gateway the token is stored as a dev.mcpg.credential.static target and resolved per call. Self-hosted, it stays in ${env.GITHUB_TOKEN} and never enters the config file.

Notes

Only one binding writes. gh.issue.create opens issues; there is no merge, no close and no delete, so an agent that goes wrong makes noise rather than changes.

GitHub counts pull requests as issues, so gh.issues.list returns both. Filter on the pull_request field if a caller needs one and not the other.

GitHub Repositories · MCPG Config