GitHub MCP Server

@sumirati/mcp-github

Model Context Protocol (MCP) server for GitHub REST API, engineered specifically for autonomous AI agents and developer workflows.

Architecturally aligned with @sumirati/mcp-gitlab, this server provides high-performance GitHub interactions with a strict Token Economy First design, native zero-dependency HTTP client, and a 3-Tier Read-Only security guard.

Key Invariants

1. Token Economy First

Raw GitHub REST API responses are notoriously heavy (often 30KB–100KB per Issue or PR). @sumirati/mcp-github incorporates automated payload summarizers across all endpoints to eliminate >80% of redundant metadata (URLs, avatar links, AST blobs, node IDs) before reaching LLM context windows:

• PR Diffs: Sliced and truncated with token-budget safeguards (max_lines, default: 400).
• Actions Logs: Tail-extracted for diagnosing failures (tail_lines, default: 200 lines) instead of megabyte log dumps.
• Search & Listings: Slim summaries focusing on titles, numbers, branches, SHAs, and states.

2. 3-Tier Read-Only Mode (GITHUBREADONLY=true)

When GITHUBREADONLY=true is set, the server enforces safety across three redundant layers:

1. Tool Discovery Filter: Mutating tools are completely omitted from ListToolsRequestSchema.
2. Dispatch Guard: Any incoming CallToolRequestSchema for a mutating tool is rejected before invocation.
3. HTTP Client Interceptor: src/client.js blocks any non-GET and non-HEAD request from being dispatched to GitHub.

3. Native Fetch Runtime

Zero bloated external SDK dependencies. Uses native Node.js 18+ fetch with automated rate-limit header parsing (x-ratelimit-remaining, x-ratelimit-reset), RFC 5988 Link pagination, and clean error formatting.

Directory Structure

MCP-github/
├── index.js                  # MCP Server entrypoint, transport & tool registration
├── package.json
├── LICENSE                   # MIT License — Copyright (c) 2026 sumirati@buggycode.net
├── NOTICE
├── README.md
└── src/
    ├── client.js             # Native fetch client, rate limits, 3-tier read-only guard
    ├── schemas.js            # Shared repo/owner base schemas & Zod to JSON Schema converter
    ├── helpers.js            # Payload summarizers (PRs, issues, commits, actions, releases, diffs)
    └── tools/
        ├── repositories.js   # Repos, search, files, branches
        ├── commits.js        # Commit history, commit details with diffs
        ├── pull-requests.js  # PRs, token-sliced diffs, review comments, reviews
        ├── issues.js         # Issues, labels, comments
        ├── milestones.js     # Milestones and deadlines
        ├── collaborators.js  # Repository collaborators and access levels
        ├── variables.js      # Actions configuration variables & secret catalog
        ├── gists.js          # Gist code snippet storage
        ├── actions.js        # Workflows, runs, safe job log tailing
        ├── releases.js       # Releases & Git t

Tool Catalog

Repositories (src/tools/repositories.js)

• search_repositories: Search repositories with queries and filters.
• get_repository: Get metadata, default branch, statistics.
• createrepository (mutating)*: Create a new repository under user or organization.
• getfilecontents: Read file or directory content (with automatic Base64 decoding).
• createorupdatefile (mutating)*: Create or update a file.
• deletefile (mutating)*: Delete a file from a repository branch.
• list_branches: List repository branches.
• get_branch: Get branch details and protection status.
• createbranch (mutating)*: Create a branch off a branch or commit SHA.
• deletebranch (mutating)*: Delete a branch (protected from deleting default branch).
• forkrepository (mutating)*: Fork a repository into user or organization namespace.

Shortened. The full README is on GitHub.