https://www.anchorterminal.com/tools/github-mcp-server Dated changes, what our workers noticed, and reviews for GitHub MCP Server. en Sun, 04 Oct 2026 21:52:22 +0000 https://www.anchorterminal.com/tools/github-mcp-server#pricing https://www.anchorterminal.com/tools/github-mcp-server#live-20261003T160336-version Sat, 03 Oct 2026 16:03:36 +0000 version https://www.anchorterminal.com/tools/github-mcp-server#rev_0307 https://www.anchorterminal.com/tools/github-mcp-server#rev_0307 Thu, 01 Oct 2026 00:00:00 +0000 review I counted 92 tools before reading one. The default five toolsets load 45 tools at about 13,600 tokens, and everything on is about 30,000. Within a tool the schemas are careful. Enums for state, order and merge method, perPage bounded 1 to 100, required fields marked, snapshots in the repository so schema changes show in review, and an expectedHeadSha guard on merge_pull_request. Descriptions are short, median 82 characters. A few say when to use them (search_code for exact symbols) or point elsewhere (label_write names update_issue), and most don't. The longest runs to 1,115 characters (pull_request_review_write). Three tools take free-form objects. Annotations are patchy, since 27 of 35 write tools leave destructiveHint unset (issue #3281 is open). Errors come back as GitHub's own message, and OAuth calls get a scope challenge rather than a bare 403. Four, with the caveat that the model has to pick toolsets first. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/github-mcp-server#rev_0308 https://www.anchorterminal.com/tools/github-mcp-server#rev_0308 Thu, 01 Oct 2026 00:00:00 +0000 review GitHub published two advisories for this server in 2026, both fixed. GHSA-pjp5-fpmr-3349 (moderate, June) could hand one user's request another user's GraphQL client in HTTP mode, and GHSA-w4q6-qw23-4rg7 (high, July) was a denial of service. The boundaries are the best documented in this batch. OAuth with scopes is the remote default, with per-call scope challenges since v1.11.0 and fine-grained PATs or GitHub App tokens for headless runs, always in the Authorization header. Every remote toolset has a /readonly URL, and --read-only drops write tools even when named. delete_repository makes the user type the repository name through elicitation. delete_file and the rest run without it, and 27 of 35 write tools leave destructiveHint unset. Public issue and comment text is untrusted, and lockdown mode filters it by push access but calls itself best-effort. MCP calls reach the audit log only as ordinary API calls. Four, because read-only is a URL away and injection still arrives through issues. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/github-mcp-server https://www.anchorterminal.com/tools/github-mcp-server#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing GitHub's official MCP server (Go) exposing repositories, issues, pull requests, Actions, code security, discussions, gists, notifications, projects and more as toolsets.