Skip to content

feat: add GitHub App authentication support #2562

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyama86 wants to merge 9 commits into from
Closed

feat: add GitHub App authentication support #2562

Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
db89352
feat: add GitHub App authentication support
pyama86 May 27, 2026
f3ad678
fix: use direct NewClient calls instead of gogithub.Option slice
pyama86 May 27, 2026
6799ef5
fix: address Copilot review feedback
pyama86 May 28, 2026
a808385
feat: support GitHub App authentication in HTTP mode
go-kazuhiko-yamashita Jun 8, 2026
1413842
Merge branch 'main' into feat/github-app-auth
pyama86 Jun 10, 2026
e62232f
Merge branch 'main' into feat/github-app-auth
pyama86 Jun 15, 2026
e9625e7
Merge upstream main into feat/github-app-auth
pyama86 Jun 27, 2026
fe2da47
Merge remote-tracking branch 'origin/feat/github-app-auth' into feat/…
pyama86 Jun 27, 2026
7fab774
Move GitHub App docs out of README
pyama86 Jun 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Move GitHub App docs out of README 
Keep the GitHub App guide under docs/ only and remove the extra README references.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  • Loading branch information
@pyama86
pyama86 and Copilot committed Jun 27, 2026
commit 7fab7740cacaba0de47f4881be1bdb259edc6503
10 changes: 2 additions & 8 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,7 +182,7 @@ GitHub Enterprise Server does not support remote server hosting. Please refer to

1. To run the server in a container, you will need to have [Docker](https://www.docker.com/) installed.
2. Once Docker is installed, you will also need to ensure Docker is running. The Docker image is available at `ghcr.io/github/github-mcp-server`. The image is public; if you get errors on pull, you may have an expired token and need to `docker logout ghcr.io`.
3. **Authentication.** On github.com you don't need to create anything up front — the one-click buttons above log you in with OAuth on first use (a browser-based flow; the token is kept in memory only). The Docker buttons publish a fixed callback port (`127.0.0.1:8085`) so the container's login callback is reachable. See **[Local Server OAuth Login](docs/oauth-login.md)** for how it works, headless/device-code fallback, and bringing your own OAuth or GitHub App client for the OAuth flow. To authenticate directly as a GitHub App installation via `GITHUB_APP_ID` / `GITHUB_APP_INSTALLATION_ID`, see **[Local Server GitHub App Authentication](docs/github-app-auth.md)**.
3. **Authentication.** On github.com you don't need to create anything up front — the one-click buttons above log you in with OAuth on first use (a browser-based flow; the token is kept in memory only). The Docker buttons publish a fixed callback port (`127.0.0.1:8085`) so the container's login callback is reachable. See **[Local Server OAuth Login](docs/oauth-login.md)** for how it works, headless/device-code fallback, and bringing your own OAuth or GitHub App (required for GitHub Enterprise Server and `ghe.com`).

Prefer a token? You can still authenticate with a [GitHub Personal Access Token](https://github.com/settings/personal-access-tokens/new) by setting `GITHUB_PERSONAL_ACCESS_TOKEN` instead (it takes precedence over OAuth). The MCP server can use many of the GitHub APIs, so enable the permissions that you feel comfortable granting your AI tools (to learn more about access tokens, please check out the [documentation](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens)).

Expand Down Expand Up @@ -242,12 +242,6 @@ To keep your GitHub PAT secure and reusable across different MCP hosts:

</details>

### GitHub App Authentication

As an alternative to user-based PAT or OAuth login, the local server can authenticate directly as a [GitHub App](https://docs.github.com/en/apps) installation using `GITHUB_APP_ID`, `GITHUB_APP_INSTALLATION_ID`, and either `GITHUB_APP_PRIVATE_KEY` or `GITHUB_APP_PRIVATE_KEY_PATH`. This works for both `stdio` and `http`, uses short-lived installation tokens, and refreshes them automatically.

See **[Local Server GitHub App Authentication](docs/github-app-auth.md)** for setup, required environment variables, Docker and VS Code examples, and GitHub Enterprise Server guidance.

### GitHub Enterprise Server and Enterprise Cloud with data residency (ghe.com)

The flag `--gh-host` and the environment variable `GITHUB_HOST` can be used to set
Expand Down Expand Up @@ -315,7 +309,7 @@ Add one of the following JSON blocks to your IDE's MCP settings.
}
```

See **[Local Server OAuth Login](docs/oauth-login.md)** for the native-binary flow (no fixed port needed), the headless/device-code fallback, GitHub Enterprise Server / `ghe.com`, and bringing your own OAuth or GitHub App client for OAuth login. For installation-based GitHub App auth, see **[Local Server GitHub App Authentication](docs/github-app-auth.md)**.
See **[Local Server OAuth Login](docs/oauth-login.md)** for the native-binary flow (no fixed port needed), the headless/device-code fallback, GitHub Enterprise Server / `ghe.com`, and bringing your own OAuth or GitHub App.

**Or authenticate with a Personal Access Token.** Set `GITHUB_PERSONAL_ACCESS_TOKEN` instead (it takes precedence over OAuth):

Expand Down