Set up the GitHub MCP server

The GitHub MCP server gives AI agents access to GitHub repositories, issues, pull requests, Actions workflows, code security findings, and more. This guide walks through creating a GitHub App, copying credentials, and connecting the server to MintMCP as a remote MCP.

Prerequisites

• A MintMCP admin account
• A GitHub account with permission to create GitHub Apps

Create a GitHub App

1. Go to github.com/organizations/YOUR-ORG/settings/apps/new (replace YOUR-ORG with your organization name). If you're registering under a personal account instead, go to github.com/settings/apps/new.

2. Enter the app name and homepage URL:

   • GitHub App name — MintMCP Org OAuth (or any name your team will recognize).
   • Homepage URL — https://app.mintmcp.com.
   

3. Set the Callback URL to https://app.mintmcp.com/oauth/callback.

4. Enable user authorization so members sign in with their own GitHub identity:

   • Check Expire user authorization tokens to issue refresh tokens.
   • Check Request user authorization (OAuth) during installation so GitHub runs the OAuth flow when a user installs the app.
   

5. Set the app's permissions to read-only access for the resources agents need:

   • Administration — Read-only.
   • Contents — Read-only.
   

6. Under Where can this GitHub App be installed?, select Only on this account, then click Create GitHub App.

   

Copy the client ID and client secret

1. On the app's settings page, copy the Client ID.

   

2. Click Generate a new client secret (highlighted above), then copy the secret immediately — you can't view it again after leaving this page.

   

Install the app

Installing the app on your organization grants it access to the repositories agents will work with.

1. In the app's left sidebar, click Install App.

   

2. Next to your organization, click Install.

   

3. Choose which repositories the app can access, then click Install & Authorize:

   • All repositories — the app can read every current and future repository in the organization.
   • Only select repositories — the app is limited to the repositories you pick.

   This is your decision: pick the scope that matches your organization's access policy. Most teams limit the app to only the repositories agents need.

   

Add GitHub to MintMCP

GitHub is a recommended server, so you install it from the connector list instead of pasting a URL.

1. In MintMCP, go to MCP store → Manage store.
2. Find GitHub in the recommended servers and click to install it.
3. Open the connector's OAuth settings and paste the Client ID and Client Secret from your GitHub App.
4. Confirm the Redirect URL shown in the connector's OAuth settings matches https://app.mintmcp.com/oauth/callback.
5. Click Install.

Each team member authorizes with their own GitHub account on first use, so tool calls are tied to their individual GitHub identity and permissions.

Limit toolsets (optional)

By default, the server enables five toolsets: context, repos, issues, pull_requests, and users. To enable additional toolsets or restrict to a subset, append the toolset path to the server URL in the connector's settings:

Goal	URL
Default toolsets	https://api.githubcopilot.com/mcp/
Enable all toolsets	https://api.githubcopilot.com/mcp/x/all
Specific toolsets	https://api.githubcopilot.com/mcp/x/repos,issues,actions
Read-only mode	https://api.githubcopilot.com/mcp/readonly

Available additional toolsets: actions, code_quality, code_security, copilot, dependabot, discussions, gists, git, labels, notifications, orgs, projects, secret_protection, security_advisories, and stargazers. Two more are remote-only: copilot_spaces and github_support_docs_search.

GitHub Enterprise

For GitHub Enterprise Cloud with data residency (ghe.com), use a different server URL when adding the remote MCP:

https://copilot-api.{subdomain}.ghe.com/mcp

Replace {subdomain} with your organization's subdomain (for example, octocorp for octocorp.ghe.com).

GitHub Enterprise Server does not support the remote MCP server — use the Hosted Connector deployment with the Docker image ghcr.io/github/github-mcp-server and a service account PAT instead.

Security considerations

• The OAuth client secret authorizes MintMCP to initiate GitHub's OAuth flow on your behalf — keep it secure and regenerate it if compromised.
• Each user authenticates with their own GitHub account, so tool calls are scoped to that user's repository access and permissions.
• Read-only mode prevents the server from making any write operations — use the /readonly URL suffix when agents should only query data. It acts as a strict filter that overrides any other toolset configuration.
• Content sanitization is on by default, so the server strips invisible Unicode characters and unsafe HTML to reduce the risk of prompt injection through repository content.
• Lockdown mode restricts content from untrusted public-repository contributors — users without push access — which limits the attack surface when agents read public repos.
• For shared service accounts or GitHub Enterprise Server, use a fine-grained PAT with minimum required scopes (repo, read:org) instead of OAuth.

Troubleshooting

• redirect_uri_mismatch during sign-in — the GitHub App's Callback URL must be exactly https://app.mintmcp.com/oauth/callback, matching the Redirect URL shown in the connector's OAuth settings.
• Write tools fail or don't appear — the GitHub App's permissions are read-only, or the server is in read-only mode. Grant the App write access to the resources agents need, and drop the /readonly suffix from the server URL.
• A tool is missing — its toolset isn't enabled. Add the toolset to the server URL (for example /x/repos,issues,actions) or switch to /x/all.

Next steps

• Tool customization — Control which GitHub tools are exposed to users
• MCP gateway administration — Manage access and permissions