The safest GitHub MCP setup starts read-only. Connect GitHub's official server, limit the credential to one disposable repository, inspect the tools, prove required reads, and deliberately prove that writes and cross-repository access fail. Enable one write permission only after that evidence exists.
ILAA rechecked the official github/github-mcp-server repository and its Codex installation guide on 27 September 2026. The documented remote endpoint is https://api.githubcopilot.com/mcp/. The guide supports OAuth or a personal access token and warns against committing credentials.
Choose the smallest authentication surface
| Choice | Use it when | Starting boundary | Stop signal |
|---|---|---|---|
| Host OAuth | Your host supports GitHub's remote OAuth flow | Only required organizations and repositories | Consent requests unrelated resources |
| Fine-grained PAT | You need explicit repository and permission selection | One lab repository; Metadata, Contents, Issues read | Only a broad classic token is available |
| Official local container | Remote transport is unavailable or policy requires local execution | Official image and a narrow token | The container receives unrelated environment secrets |
Remote setup for Codex
[mcp_servers.github]
url = "https://api.githubcopilot.com/mcp/"
bearer_token_env_var = "GITHUB_PAT_TOKEN"Put GITHUB_PAT_TOKEN in the secret store or environment used to launch the host, never in the configuration file or transcript.
Original asset: the read-before-write permission matrix
Create an empty private repository named mcp-permission-lab, add one README and one issue, then run these rows in order. Record the server identity, tool name, redacted arguments, result, and timestamp.
| Test | Initial permission | Pass condition |
|---|---|---|
| Repository identity | Metadata: read | Correct owner, visibility, and default branch |
| File read | Contents: read | Exact README and commit reference |
| Issue read | Issues: read | Exact title and number |
| Blocked write | Issues: read | Create request is denied; issue count is unchanged |
| Cross-repository escape | Token limited to the lab | Another private repository stays invisible |
| Scoped write | Issues: write after approval | Only the named probe issue changes and both actions are logged |
Gate: identity, file read, issue read, denied write, and cross-repository denial must score 5/5 before write access is enabled. Tool visibility is not authorization; enforce the boundary in both the MCP configuration and GitHub credential.
Troubleshooting without widening the token
| Symptom | Check first | Do not do |
|---|---|---|
| 401 | Expiry, environment name, endpoint | Paste the token into config |
| No tools | Host status, logs, selected toolsets | Grant every permission |
| Issue creation fails | Expected during the read-only phase | Add administration permission |
| Org repository missing | Organization approval and selected-repo access | Default to a broad classic PAT |
Bottom line: required reads should succeed, unrelated repositories should remain invisible, and writes should fail until a named permission and approval are added.