
GitHub MCP Server
io.github.sumirati由 GitHub 账号 sumirati 发布v2.2.0更新于 Oct 31, 2026
Developer-ready GitHub MCP server with 5-tool hybrid architecture and dynamic discovery.
概览
本地运行的 MCP 服务器,通过 5 个工具和 83 个可发现操作,让助手调用 GitHub REST API 完成仓库、代码与协作任务。
- 可以做什么
- 发现并执行 GitHub 操作:按领域检索操作,再执行 83 个操作之一,输入会经过校验。
- 读取仓库与代码:仓库元数据、文件内容(含符号大纲与行范围)、分支、提交与差异。
- 处理拉取请求与议题:列出、查看差异与评审、创建、更新、评论、合并,管理标签与里程碑。
- 管理仓库设置:协作者与权限、Actions 变量与密钥元数据、Webhook、主题、Gist、发布与标签。
- 查看 CI/CD 与安全:工作流、运行记录、任务日志、构建产物、提交状态与 Dependabot 告警。
- 适用场景
- 适合希望助手在对话中直接操作 GitHub 仓库的场景,例如审查拉取请求、阅读代码、整理议题、排查 CI 失败,或无需本地克隆就提交小改动。5 工具混合模式对只需偶尔访问 GitHub 的智能体更省上下文。
- 运行要求
- 以 npx 或全局 npm 安装方式在本地运行,需要 Node.js。需要 GitHub 个人访问令牌,放在 GITHUB_PERSONAL_ACCESS_TOKEN 中(也接受 GITHUB_TOKEN)。可选配置:GITHUB_API_URL(用于 GitHub Enterprise)、GITHUB_READ_ONLY、GITHUB_EXPOSE_ALL_TOOLS 和 MCP_OUTPUT_FORMAT。需要访问 GitHub API 的网络连接。
安装
在 SourceWeft 中
- 打开 控制台中的 GitHub MCP Server,将其添加到工作区。
- 为需要使用其工具的对话启用该服务。
Desktop only,通过 STDIO。 STDIO 服务会启动本地进程,因此需要 SourceWeft 桌面宿主。
其他 MCP 客户端
参照 仓库 中的启动说明。
README
GitHub MCP Server (@sumirati/mcp-github)
A modern, 2026 AI-native Model Context Protocol (MCP) server for GitHub REST API, engineered for autonomous AI agents and developer workflows.
[npm version] [License: MIT] [GitHub]
What makes v2 Unique: The 2026 5-Tool Hybrid Standard
In early MCP servers, exposing 50–100+ eager tool definitions flooded every LLM turn with thousands of redundant schema tokens ("System Prompt Tax") and degraded reasoning coherence.
@sumirati/mcp-github solves this with a 5-Tool Hybrid Surface:
- Glama TDQS Coherence Tier A (5/5): By exposing exactly 5 tools to the client, the server sits in the ideal 3–15 tool coherence sweet spot.
- Ultra-Lean System Prompt Tax: Drops schema overhead from 23,112 tokens (92,447 B) down to 1,125 tokens (4,498 B) (95.1% reduction), preserving context windows and maximizing LLM prompt-cache hits.
- Zero-Hop Hourly Drivers: The 3 operations developers and agents use constantly (
get_file_contents,get_repository,get_commit) remain eager tools for instant zero-hop execution. - 100% Platform Access on Demand: The entire platform surface of 83 actions across 13 domains is accessible on-demand via dynamic action discovery (
github_find_actions$\rightarrow$github_execute_action), delivering 91%–99% token savings with default high-density Markdown tables and summaries (format: "markdown" | "json"). - Resilient Fallback: If an agent directly invokes any catalog action name (e.g.
list_pull_requests), the server dynamically executes it with full input validation and projection.
Core Capabilities Across 13 Domains
- Repositories & Branch Governance (
repositories, 12 actions): Full repository lifecycle, branch management, branch protection rules (get_branch_protection), file reading (auto Base64-decoded, symbol outlines, line slicing), single-file commits, and forks. - Commits & Commit Statuses (
commits, 6 actions): Commit history, token-capped commit diffs (get_commit), atomic multi-file commits via Git Trees API (create_commit,push_files), and commit status checks. - Pull Requests & Code Reviews (
pull-requests, 11 actions): PR lifecycle (create,update,merge), review comments, inline diff reviews, and unified diff inspection with lockfile filtering. - Issues & Labels (
issues, 8 actions): Issue tracking, upstream indexed filtering, conversation comments, and label management. - Project Milestones (
milestones, 4 actions): Milestone creation, progress tracking, and deadline management. - Collaborators & Permissions (
collaborators, 4 actions): Audit and manage repository collaborators and permission levels. - Actions Variables & Secrets (
variables, 6 actions): Manage repository Actions configuration variables and inspect secret metadata. - Gists & Code Snippets (
gists, 5 actions): Full gist lifecycle for sharing multi-file code snippets and configurations. - GitHub Actions & CI/CD (
actions, 10 actions): Workflow inspection, workflow runs, job step breakdown, build artifacts (list_workflow_run_artifacts,get_workflow_run_artifact), smart failure log extraction (get_job_logs), run cancel/rerun, and manual workflow dispatch. - Releases & Git Tags (
releases, 5 actions): Release publishing, lightweight/annotated tag creation, and release asset inspection. - User, Organizations, Teams & Diagnostics (
user, 7 actions): Authenticated user identity, organization inspection, team creation (create_team), accessible repositories, and API health/rate-limit diagnostics (system_health_check). - Webhooks & Repository Topics (
webhooks, 4 actions): Audit repository event webhooks and manage repository topic tags. - Security & Dependabot (
security, 1 action): Audit Dependabot vulnerability alerts by state and severity.
Quickstart & Installation
Option 1: Run with npx (No installation needed)
Option 2: Install Globally
Option 3: Local Clone
Environment Configuration
Client Configuration
Google Antigravity / Claude Desktop / Cursor
Add to your MCP configuration file (mcp_config.json or claude_desktop_config.json):
Using npm / npx (Recommended):
Using local clone:
Complete Action Catalog Reference (83 Actions)
All 83 actions feature strict Zod input validation and 2-tier output projection:
1. The 5 Client-Exposed Tools (Hybrid Mode)
2. Repositories & Branches (repositories — 12 actions)
3. Git Commits & Statuses (commits — 6 actions)
4. Pull Requests & Code Reviews (pull-requests — 11 actions)
5. Issues & Labels (issues — 8 actions)
6. Project Milestones (milestones — 4 actions)
7. Collaborators & Roles (collaborators — 4 actions)
8. Actions Variables & Secrets (variables — 6 actions)
9. Gists & Code Snippets (gists — 5 actions)
10. GitHub Actions & CI/CD Observability (actions — 10 actions)
11. Releases & Git Tags (releases — 5 actions)
12. User, Organizations & Teams (user — 7 actions)
13. Webhooks & Topics (webhooks — 4 actions)
14. Security & Dependabot (security — 1 action)
Benchmarks: Reproducible Token Economy Proof (test/benchmark-test.js)
Grounded strictly in official GitHub REST API (2022-11-28) response schemas (test/fixtures/github-api-v3-fixtures.js) and verified on every npm test run via node test/benchmark-test.js:
How Token Compression Works
- System Prompt Tax Reduction (95.1% savings): Shrinks MCP
ListToolsschema footprint from 83 full tool schemas (23,112 tokens / 92,447 B) down to the 5-tool hybrid surface (1,125 tokens / 4,498 B). - Recursive Output Projection Filter (
projectOutput): Automatically strips GitHub REST API v3 hypermedia template URLs (*_urlRFC 6570 templates),avatar_url,gravatar_id,node_id,site_admin,_links, internalapi.github.comself-links, andnull/""fields. - Smart Diff & Lockfile Truncation: Commit and PR diffs automatically collapse dependency lockfiles (
package-lock.json,pnpm-lock.yaml,yarn.lock,go.sum,Cargo.lock,*.min.js) viaignore_lockfiles: trueby default. Passignore_lockfiles: falseto inspect full lockfile diffs. - Conservative Default Pagination: All list actions default to
per_page: 10(max: 100). - Default High-Density Markdown Format: Discovery (
github_find_actions), execution (github_execute_action), and all 3 eager tools default toformat: "markdown". - Unified Diff Truncation: PR (
max_lines) and commit (max_diff_lines) diffs default to 400 lines. - Safe Log Tailing: CI workflow job logs extract the failure block and teardown tail (
tail_lines, default: 100) with ANSI escape sequence stripping.
Roadmap
Completed in v2.1
- Upstream indexed filtering & strict pagination caps (
state,labels,assignee,creator,mentioned,milestone,since) - Client error resilience (Secondary rate limit / abuse detection, 403/404 scope diagnostics, empty-body 201/202 handling)
- Hardened output projection with recursion depth guard (
maxDepth = 32), RFC 6570 hypermedia URL stripping, and empty collection preservation - Nested child team & organization management (
create_team,get_organization) - Smart CI/CD failure log extraction & ANSI sequence stripping in
get_job_logs(strip_ansi,smart_failure) - Outline-first code symbol extraction & line range slicing in
get_file_contents(outline_only,start_line,end_line) - Atomic multi-file commits (
create_commit,push_files) supporting file creation, updates, and deletions via GitHub Git Trees API - Pre-flight mergeability & conflict verification (
get_mergeability) - Token scope self-auditing & permission pre-flight
Future Horizons (v2.x)
- Standardized collection
_summaryheaders to facilitate multi-turn history pruning in LiteLLM / Eigent agent orchestration - Remote Transports: Streamable SSE and HTTP remote server modes
- Scoped GraphQL query engine for relational deep inspections
- DevSecOps code scanning & secret scanning alert queries
- Scoped & rate-guarded code search within project repositories
Acknowledgements & Lineage
This project incorporates architectural concepts, schemas, and patterns from:
@modelcontextprotocol/sdk(MIT License) — Copyright (c) Anthropic, PBC.zod(MIT License) — Colin McDonnell.- GitHub REST API Specifications — GitHub, Inc.
jmrplens/gitlab-mcp-server— Dynamic action discovery and meta-dispatcher pattern concepts.@sumirati/mcp-gitlab— Sibling project architecture, 3-tier read-only mode, and token projection standards.
See NOTICE for complete third-party attribution details.
License
This project is licensed under the MIT License — Copyright (c) 2026 [email protected].
来源:README.md,提交 ce7318f
工具
0版本历史
4- v2.2.0最新Oct 17, 2026
- v2.1.0Oct 16, 2026
- v1.3.1Oct 15, 2026
- v1.0.0Oct 15, 2026
评分
已满足适用检查项的 50%
该评分衡量此收录条目的完整程度,依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价,也不表示服务器安全或当前可用:可连通性是带日期的检查结果,评分也不包含安装量或用户评价。
- 近 30 天内可连通25 分
请保持端点能够响应 MCP 握手;SourceWeft 每 30 天探测一次。
- 已声明认证方式10 分
请在注册中心条目中声明凭据请求头,或保持端点能够响应探测,以便判定其认证方式。
- 已列出工具15 分
请让服务器在无凭据时响应 tools/list,或发布可在沙箱中无凭据启动的软件包。
- 描述必需15 分
- 图标10 分
- 文档15 分
- 许可证10 分