GitHub MCP (official)

---
name: github-mcp
category: osint-technical-infrastructure
cost: free
api_key_required: yes
repo: https://github.com/github/github-mcp-server
paired_skills: ["github-and-source-leak-search"]
capabilities: ["code-search", "secret-scanning", "source-leak"]
---

# GitHub MCP (official) — authenticated code search, secret scanning, source-leak hunting

GitHub's official MCP server. Runs authenticated code search, pulls commits and file histories, and surfaces secret-scanning alerts.

## Install

Via Docker (recommended):

```
docker pull ghcr.io/github/github-mcp-server
```

Or via the GitHub CLI extension:

```
gh extension install github/gh-mcp
```

## Configuration

```json
{
  "mcpServers": {
    "github": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "GITHUB_PERSONAL_ACCESS_TOKEN",
        "ghcr.io/github/github-mcp-server"
      ],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "YOUR_GITHUB_TOKEN_HERE"
      }
    }
  }
}
```

Generate a PAT at github.com/settings/tokens with `repo` and `read:org` scopes.

## What it adds

Claude runs authenticated code search to find leaked credentials, internal API endpoints, private-repo names in public commits, and hardcoded secrets. Also surfaces GitHub secret-scanning alerts (GA as of 2026) for repos you have access to. Critical for corporate investigations where developers may have pushed sensitive material to personal repos.

## Pairs with skills

- 046 `github-and-source-leak-search`

## Cost

Free with a GitHub account. Requires a Personal Access Token (PAT).