github-featured/github--github-mcp-server

Files

T

Sam Morrow fab5fc5ff2 docs: lead local/stdio install with OAuth login (#2776 )

* docs: lead local/stdio install with OAuth login

Surface OAuth 2.1 login as a first-class option above the Personal Access
Token in the README install section and in every local-capable installation
guide, each in that client's own config syntax, linking to the dedicated
docs/oauth-login.md guide.

The github.com OAuth example needs no token; in Docker it publishes a fixed
callback port to loopback (-p 127.0.0.1:8085:8085). The PAT block is retained
below it and noted as taking precedence over OAuth.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs(oauth): correct PKCE/client-secret explanation

The previous "How it works" text claimed PKCE removes the need for a client
secret. In practice GitHub requires the client secret at the token endpoint for
both OAuth Apps and GitHub Apps, and the implementation sends it alongside the
PKCE verifier (Manager.oauth2Config populates ClientSecret; flow.go exchanges
with VerifierOption). The secret is baked into the distributed binary and is not
truly confidential; PKCE is what actually secures the flow. Reword to reflect
this accurately.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: don't frame OAuth login as github.com-only

The intro line said "On github.com you can skip the token entirely", which
implied OAuth login only works on github.com. OAuth works on GitHub Enterprise
too — you just supply your own app credentials there. Reword to lead with OAuth
as the mechanism and scope the zero-config claim correctly: on github.com the
official image already includes the app credentials, so the user provides none.
Enterprise / bring-your-own-app is covered by the linked OAuth guide.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-06-26 14:45:06 +02:00

2.9 KiB

Raw Permalink Blame History

Install GitHub MCP Server in Roo Code

Roo Code is an AI coding assistant that runs in VS Code-compatible editors (VS Code, Cursor, Windsurf, etc.). For general setup information (prerequisites, Docker installation, security best practices), see the Installation Guides README.

Remote Server

Step-by-step setup

Click the Roo Code icon in your editor's sidebar to open the Roo Code pane
Click the gear icon (⚙️) in the top navigation of the Roo Code pane, then click on "MCP Servers" icon on the left.
Scroll to the bottom and click "Edit Global MCP" (for all projects) or "Edit Project MCP" (for the current project only)
Add the configuration below to the opened file (mcp_settings.json or .roo/mcp.json)
Replace YOUR_GITHUB_PAT with your GitHub Personal Access Token
Save the file — the server should connect automatically

{
  "mcpServers": {
    "github": {
      "type": "streamable-http",
      "url": "https://api.githubcopilot.com/mcp/",
      "headers": {
        "Authorization": "Bearer YOUR_GITHUB_PAT"
      }
    }
  }
}

Important: The type must be "streamable-http" (with hyphen). Using "http" or omitting the type will fail.

To customize toolsets, add server-side headers like X-MCP-Toolsets or X-MCP-Readonly to the headers object — see Server Configuration Guide.

Local Server (Docker)

Log in with OAuth instead of a token. On github.com the official image already includes the app credentials, so you provide none yourself — the server opens a browser login on first use and keeps the token in memory only. In Docker, publish a fixed callback port to loopback:

{
  "mcpServers": {
    "github": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-p", "127.0.0.1:8085:8085",
        "-e", "GITHUB_OAUTH_CALLBACK_PORT",
        "ghcr.io/github/github-mcp-server"
      ],
      "env": {
        "GITHUB_OAUTH_CALLBACK_PORT": "8085"
      }
    }
  }
}

See Local Server OAuth Login for the native-binary flow (no fixed port), headless/device-code fallback, GitHub Enterprise, and bringing your own OAuth or GitHub App.

To authenticate with a Personal Access Token instead (replace YOUR_GITHUB_PAT; it takes precedence over OAuth):

{
  "mcpServers": {
    "github": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "GITHUB_PERSONAL_ACCESS_TOKEN",
        "ghcr.io/github/github-mcp-server"
      ],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "YOUR_GITHUB_PAT"
      }
    }
  }
}

Troubleshooting

Connection failures: Ensure type is streamable-http, not http
Authentication failures: Verify PAT is prefixed with Bearer in the Authorization header
Docker issues: Ensure Docker Desktop is running

2.9 KiB Raw Permalink Blame History