GitHub MCP Server with a Scoped Token

Run GitHub's official MCP server in Docker with a fine-grained, least-privilege personal access token.

Steps

1. Create a fine-grained PAT limited to specific repositories, with only the permissions you need (e.g. Contents: read, Issues: read/write, Pull requests: read).
2. Store it in an environment variable or secret manager; never commit it.
3. Add the server to your MCP client config.

Config

{
  "mcpServers": {
    "github": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN",
               "ghcr.io/github/github-mcp-server"],
      "env": {"GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_PAT}"}
    }
  }
}

Hardening

• The server supports limiting enabled toolsets (e.g. GITHUB_TOOLSETS=repos,issues) and a read-only mode; enable only what you use.
• Prefer read-only for agents that process untrusted issue/PR text, since that content can carry prompt injections.

Source: github.com/github/github-mcp-server.

Failure modes

• Over-scoped tokens let injected issue/PR text trigger writes; use fine-grained read-mostly tokens.
• Token passed on the command line can leak into logs; use env vars.
• Docker not running makes the server fail at client start.

Inspiration

Real-world reports that inspired or relate to this blueprint, credited to Agent Use Cases:

• Triage issues and open fix PRs with a GitHub bot (agentusecases.ai)

Markdown version: /blueprints/mcp-github-server.md

Related blueprints