GitHub Release MCP

io.github.zishuowang696Published by GitHub account zishuowang696v0.1.1Updated Oct 24, 2026

List and download GitHub release assets with multi-mirror parallel ranged download.

VerifiedSTDIODesktop onlyFiles & StorageDeveloper Tools

Overview

AI-generated overview

A local MCP server that lets an assistant list and download GitHub release assets, with multi-mirror parallel ranged download and sha256 verification.

What you can do
List a release's assets for a repository, with name, size and download URL. Download one asset by exact name or several by glob pattern into a chosen directory. Fetch segments in parallel across mirrors and verify sha256 when GitHub provides an asset digest.
When to use it
When you want an assistant to fetch installers or binaries from GitHub releases, especially on restricted or unreliable networks. Also useful for grabbing several assets by pattern and confirming their integrity.
Requirements
Runs locally as a Python process, either via uvx or after a pip install, and speaks MCP over stdio. An optional GITHUB_TOKEN environment variable raises API limits and allows private repositories. Needs network access to the GitHub API and to the chosen mirrors.
Before you install
Downloads write files to a local directory, by default the current working directory, so check the destination. Traffic goes through third-party mirrors, by default ghproxy.net and ghfast.top, which therefore see the files being fetched. If GITHUB_TOKEN is set, that credential is used for GitHub API requests and should be kept safe.

Installation

In SourceWeft

  1. Open GitHub Release MCP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

gh-release-mcp

An MCP server that lets an agent list and download GitHub release assets — with multi-mirror parallel ranged download and sha256 verification. Zero external binaries (pure Python standard library: no aria2, curl, gh, jq). By embedai.com.cn.

Built for restricted networks: it probes which mirrors support HTTP Range (206), splits a file across mirrors and downloads segments in parallel, then verifies sha256 from GitHub's own asset digest.

Tools

ToolWhat it does
list_release_assetsList a release's assets (name, size, url).
download_release_assetDownload one asset (by name) or several (by glob pattern) with parallel ranged requests across mirrors; verifies sha256 when available.

Install / run

bash
# run instantly (no install)uvx gh-release-mcp
# or via pippip install gh-release-mcpgh-release-mcp

It speaks MCP over stdio.

Configure your client

opencode (opencode.json):

jsonc
{  "mcp": {    "gh-release": {      "type": "local",      "command": ["uvx", "gh-release-mcp"]    }  }}

Claude Desktop / Cursor (mcpServers):

json
{  "mcpServers": {    "gh-release": { "command": "uvx", "args": ["gh-release-mcp"] }  }}

Tools in detail

download_release_asset arguments:

argmeaning
owner, repoe.g. NationalSecurityAgency, ghidra
tagrelease tag; omit or latest
nameexact asset name (optional)
patternglob, e.g. *PUBLIC*.zip (optional)
destdestination directory (default: cwd)
mirrorsmirror prefixes (must support Range); default ghproxy.net + ghfast.top
connectionssegments per file (default 8)

Env vars: GITHUB_TOKEN (optional, raises API limits / private repos).

Example prompts

  • "Using gh-release, list the assets of BurntSushi/ripgrep latest."
  • "Download NationalSecurityAgency/ghidra Ghidra_12.1.4_build matching *PUBLIC*.zip into ./ghidra."

Related

License

MIT

Source: README.md at commit f80ef95

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestOct 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts