GitHub
Connect GitHub's hosted MCP server so the agent can read commits, pull requests, workflow runs and code.
GitHub hosts its MCP server at https://api.githubcopilot.com/mcp/. There's nothing to run. The agent can then
answer what changed before the incident?, why did the deploy workflow fail? or which PR touched this file?
| Setting | Value |
|---|---|
| Endpoint URL | https://api.githubcopilot.com/mcp/readonly, or a toolset URL (below) |
| Transport | Streamable HTTP |
| Authentication | OAuth with a GitHub App (recommended), or Bearer token with a personal access token |
Choose the endpoint
Every GitHub endpoint has a /readonly form that only exposes read tools. Use it.
| Endpoint URL | Tools |
|---|---|
https://api.githubcopilot.com/mcp/readonly | GitHub's default toolsets, read-only |
https://api.githubcopilot.com/mcp/x/actions/readonly | Workflow runs and job logs |
https://api.githubcopilot.com/mcp/x/repos/readonly | Commits, files, branches, releases, code search |
https://api.githubcopilot.com/mcp/x/pull_requests/readonly | Pull requests and reviews |
For incident work, actions and repos are the most useful. Onboard each toolset you want as its own server (for example github-actions and github-repos), or use the default URL for a bit of everything.
Option A: OAuth with a GitHub App (recommended)
A GitHub App's permissions decide what its tokens can do, so you can make it read-only. The agent acts as the person who connects, limited to the repositories where the app is installed.
Create the GitHub App
In GitHub, open Settings → Developer settings → GitHub Apps → New GitHub App (under your organization's settings for an organization-owned app):
- Callback URL:
https://app.sremcp.com/oauth/mcp/callback - Webhook: untick Active.
- Repository permissions, all Read-only: Contents, Metadata, Pull requests, Issues, Actions, Commit statuses. Add others only if you need them.
Create it, then Generate a new client secret. Copy the Client ID and the secret.
Install it
From the app's page, Install App on your organization, for all repositories or the ones the team should investigate.
Onboard in sremcp
Onboard server with the endpoint above, Transport Streamable HTTP, Authentication OAuth (sign in with the server), and both the Client ID and the Client secret. Save as draft.
Connect
Click Connect, approve the app on GitHub, and you're back with connected. GitHub App tokens expire after a few hours; sremcp renews them on its own.
GitHub needs the client secret
Without it, GitHub refuses the sign-in with The client_id and/or client_secret passed are incorrect. Add it with Rotate client secret on the server's page, then Connect again.
OAuth App instead of a GitHub App? It works the same way, but OAuth Apps use scopes, and GitHub's default list
includes write scopes (repo, write:packages, project, gist). Set Scopes when you onboard, for example
repo read:org read:user. GitHub has no read-only scope for private repositories, so a GitHub App is the tighter
choice.
Option B: a fine-grained personal access token
Simpler, but every call acts as the token's owner, and you rotate it yourself.
- In GitHub, Settings → Developer settings → Personal access tokens → Fine-grained tokens → Generate new token.
- Choose the resource owner and repositories, and only Read-only permissions (Contents, Metadata, Pull requests, Actions, Issues).
- In sremcp: Authentication Bearer token, the token as the Secret.
Approve tools
Click Test connection, then approve what investigations need, for example:
list_commits,get_commit,get_file_contents,search_code,list_releaseslist_pull_requests,pull_request_readactions_list,actions_get,get_job_logs
Leave out anything that triggers or changes things, such as actions_run_trigger. The /readonly endpoints already
hide most of them.
Try it
- What was merged to main in the 2 hours before 14:00 UTC today?
- Why did the last deploy workflow on payments-api fail?
- Which recent PRs touched
checkout/retry.go?