Is the GitHub MCP server safe?

anlyon.dev has not been able to list its tools, so it has no classes or findings for it yet. It asks for sign-in before listing them. Paste its tools/list output into https://anlyon.dev/scan to check it yourself.

Who publishes the GitHub MCP server?

github (GitHub account verified by the MCP Registry).

GitHub MCP server

io.github.github/github-mcp-servergithubremotev2.1.0

Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.

No tools shown: it asks for sign-in first

This server lists its tools only to a signed-in client (OAuth). anlyon.dev never signs in or sends credentials, so it cannot read them, and nothing here is a judgement of the server. Already use it? Copy its tools/list from your client and check it here: the same labels, worked out in your browser.

Sign-in required, OAuth metadata published. Remote posture

Anlyon alternative

Everything your agent needs in GitHub. None of the key.

Anlyon has its own GitHub integration. Every write runs under a limit you set and comes back with a receipt read from the provider.

anlyon.dev does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

See the GitHub integration →

Its sign-in does not let Anlyon set up an OAuth client on its own, so there is no link to it here.

What the GitHub MCP server can do

The GitHub MCP server is published by the GitHub account github. It asks for sign-in (OAuth) before it lists its tools, and anlyon.dev never signs in, so its tools are not shown.

Scan status: sign-in required

Scopes it asks for: gist, notifications, project, read:org, read:packages, read:project, read:user, repo, user:email, write:packages

Last attempt Nov 3, 2026, 11:18 UTC.

Have its tools/list output? Check it yourself.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Sign-in required, OAuth metadata published

Looked at Nov 13, 2026, 12:03 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 401
tools/list served without credentials: no
Tools that change things, listed without credentials: 0
Protocol version: not observed
WWW-Authenticate on 401: yes
resource_metadata in WWW-Authenticate: https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp/
RFC 9728 protected resource metadata: https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp/
Authorization servers: https://github.com/login/oauth
Legacy HTTP+SSE transport: no
Dynamic client registration: no
Client ID metadata documents: no

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 2.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http github https://api.githubcopilot.com/mcp/

claude mcp add --transport http github https://api.githubcopilot.com/mcp/

Run in a terminal.

Badge

A badge for your README that links back to this page.

Badge

[![anlyon.dev](https://anlyon.dev/badge/io.github.github/github-mcp-server.svg)](https://anlyon.dev/servers/io.github.github/github-mcp-server)

Source: MCP Registry · repository. Synced Nov 3, 2026, 11:17 UTC.