GitHub MCP server: what an AI agent can do in your repositories and how to limit it

The GitHub MCP server lets a compatible AI agent read repository files, issues and pull requests, and perform writes when authorized. In VS Code, you can connect the hosted server using OAuth or a personal access token (PAT); start with server-enforced read-only mode and selected toolsets. The official repository contains the tools list, while the configuration guide explains how to restrict it.

What it can do

A useful first task is repository investigation: ask the agent to explain a file, summarize an issue discussion, or compare a pull request's stated purpose with its diff. Require links and distinguish retrieved evidence from the agent's interpretation. For protocol basics, see what MCP is; this guide belongs to MCP servers for apps.

These are representative tools from the official tools list, checked as of 30 Oct 2026:

The table is a starting point, not a complete inventory. For your installation, inspect the tools actually exposed after authentication and filtering. Keep posting, editing and merging out of the first trial: an agent can draft a proposed comment in chat for a person to review.

For example, ask it to read a chosen PR's diff, identify assumptions that need checking, and return findings with file references. Then compare those findings with the actual patch. A fluent explanation alone is weak evidence; a useful report tells you what was inspected and what remains unknown.

How to connect it safely

1. Define the first task and repository. Choose a repository you are authorized to use and a question that needs no changes. Write down the allowed input and expected output. Follow the MCP server security checklist before connecting private material. Treat issue text and repository documents as untrusted input, even when they contain apparent instructions for the agent.

2. Choose a supported client and connection. GitHub documents hosted and local deployment; the hosted endpoint is https://api.githubcopilot.com/mcp/. In VS Code, the documented gallery route is Extensions → search @mcp github → select the official server. Review its publisher and configuration before trusting it. GitHub's setup instructions also describe checking it with MCP: List Servers. Installing an editor extension does not by itself establish a working connection.

3. Apply read-only mode before the first task. The server configuration guide documents X-MCP-Readonly: true for remote connections and --read-only or GITHUB_READ_ONLY locally. Use X-MCP-Toolsets remotely, or --toolsets / GITHUB_TOOLSETS locally, to select groups such as repos,issues,pull_requests. Read-only mode removes write tools even when explicitly requested. Toolsets choose capabilities; they do not select which repositories a credential may access.

OAuth example for VS Code's Local harness: merge this server entry into workspace .vscode/mcp.json, preserving any existing entries. Complete the sign-in prompt when connecting:

json { "servers": { "github-investigation": { "type": "http", "url": "https://api.githubcopilot.com/mcp/", "headers": { "X-MCP-Toolsets": "repos,issues,pull_requests", "X-MCP-Readonly": "true" } } } }

VS Code's documentation, checked as of 30 Oct 2026, labels this Local harness destination as deprecated but available for compatibility. Other harnesses use portable mcpServers configurations; check the current documentation before adapting this servers example. The remote server documentation also offers https://api.githubcopilot.com/mcp/readonly for the default toolsets in read-only mode.

4. Authenticate with the smallest useful access. The repository's authentication examples show OAuth and PAT connections. Review the OAuth consent screen rather than assuming it matches the task. If using a PAT, prefer a fine-grained token where supported, select the necessary repositories and permissions, and set an expiration. GitHub's PAT documentation describes feature gaps and possible organization approval. Keep credentials out of chat and committed configuration; use the client's documented secret handling.

5. Verify a real read. Ask the agent to use GitHub MCP to retrieve a known file from the chosen repository and explain a specific function. Inspect the expanded tool call, its server identity and returned content, following VS Code's verification guidance. Check that write tools are absent. Keep other file, shell and network tools under their own controls: a restriction on this server does not constrain every action in the editor.

6. Add writes only for an explicit next task. First review a draft in chat. If creating a PR becomes necessary, separately review credential permissions, enable the needed tools, and change read-only configuration deliberately. Keep the target repository, base branch and expected change explicit. Enabling writes should trigger a fresh acceptance check, not become a permanent shortcut for every future task.

When this does not work

A successful sign-in does not prove access to the requested resource. A PAT cannot exceed its owner's permissions, and fine-grained tokens may await organization approval. Check the account, repository selection and token restrictions before broadening access.

Missing tools can reflect disabled toolsets or read-only filtering; misspelled individual tool names can prevent startup. See the configuration troubleshooting table. Restore the intended configuration before retrying the task.

Client support and organizational policy also matter. GitHub documents an MCP policy requirement for relevant managed Copilot accounts in its setup guide. Remote and local deployments are not identical: the hosted service has additional toolsets, listed in the remote documentation.

Finally, read-only access still reveals information to the consuming agent. Decide which private code and discussions may enter that workflow. Read MCP versus APIs and function calling when deciding whether an agent-facing interface is appropriate at all.

Where Tvijo fits

The DSHREM VS Code extension and TvijoCode are Tvijo's editor-side clients. TvijoCode is a test build with the extension embedded. In a proposed GitHub workflow they occupy the client side, but a ready GitHub MCP connection is not an advertised capability here. Check external MCP support in the exact client build before applying the connection recipe above.

Tvijo MCP exposes Tvijo capabilities to a compatible MCP client; that direction does not automatically give DSHREM access to GitHub tools. The Tvijo MCP status report, as of 28 Oct 2026, describes prepared review of a supplied diff awaiting publication, with editor integration and delegation still planned. That review path does not fetch repositories or merge changes. The practical rollout remains read-only first, write permissions later, after checking client support and the intended action.

As of 30 Oct 2026, the DSHREM offer lists the free start at $0: "Up to 5 tasks, 50,000 tokens or $0.05 of sponsored usage, whichever is reached first. Shared $1 daily pool funded by TVIJO." Prepaid service credit is metered provider usage plus an 8% service markup; payment collection is not activated. These are Tvijo terms, separate from GitHub access requirements.

FAQ

Where is the GitHub MCP tools list?

Use the official repository, then compare it with your client's exposed tools. Treat the article's examples as a selection rather than a fixed inventory.

Does read-only mode restrict the agent's whole session?

It filters this server's write tools. Review the agent's other tools and credentials separately; a chat instruction to avoid changes is not equivalent to that filter.

Should I use OAuth or a PAT?

Use the authentication method supported by your client and organization. Review OAuth consent; for a PAT, check repository selection, required permissions and expiration against the current documentation.

GitHub is a trademark of its owner. Tvijo is not affiliated with or endorsed by it.