# GitHub MCP Server with a Scoped Token

> Run GitHub's official MCP server in Docker with a fine-grained, least-privilege personal access token.

Category: MCP & Tool Use  
Tags: mcp, github, docker, security  
Setup time (estimate): 20-30 minutes  
Estimated cost: Free; requires Docker and a GitHub account.  
Last verified: 2026-10-14

## Steps

1. Create a **fine-grained** PAT limited to specific repositories, with only the permissions you need (e.g. Contents: read, Issues: read/write, Pull requests: read).
2. Store it in an environment variable or secret manager; never commit it.
3. Add the server to your MCP client config.

## Config

```json
{
  "mcpServers": {
    "github": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN",
               "ghcr.io/github/github-mcp-server"],
      "env": {"GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_PAT}"}
    }
  }
}
```

## Hardening

- The server supports limiting enabled toolsets (e.g. `GITHUB_TOOLSETS=repos,issues`) and a read-only mode; enable only what you use.
- Prefer read-only for agents that process untrusted issue/PR text, since that content can carry prompt injections.

Source: github.com/github/github-mcp-server.

## Failure modes

- Over-scoped tokens let injected issue/PR text trigger writes; use fine-grained read-mostly tokens.
- Token passed on the command line can leak into logs; use env vars.
- Docker not running makes the server fail at client start.