Skip to content

Commit ed6c671

Browse files
SamMorrowDrumsCopilot
SamMorrowDrums
and
Copilot
committed
docs: lead local/stdio install with OAuth login
Surface OAuth 2.1 login as a first-class option above the Personal Access Token in the README install section and in every local-capable installation guide, each in that client's own config syntax, linking to the dedicated docs/oauth-login.md guide. The github.com OAuth example needs no token; in Docker it publishes a fixed callback port to loopback (-p 127.0.0.1:8085:8085). The PAT block is retained below it and noted as taking precedence over OAuth. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 8ce77e3 commit ed6c671

14 files changed

Lines changed: 464 additions & 6 deletions

‎README.md‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -280,9 +280,38 @@ More about using MCP server tools in VS Code's [agent mode documentation](https:
280280

281281
Install in GitHub Copilot on other IDEs (JetBrains, Visual Studio, Eclipse, etc.)
282282

283-
Add the following JSON block to your IDE's MCP settings.
283+
Add one of the following JSON blocks to your IDE's MCP settings.
284284

285-
> The examples below authenticate with a Personal Access Token. To log in with OAuth instead (no token to create or store), see **[Local Server OAuth Login](docs/oauth-login.md)** — in Docker it needs a fixed callback port, as the one-click buttons above show.
285+
**Log in with OAuth (no token to create or store).** On github.com you can start the server with no token at all: it runs a browser-based login on first use and keeps the resulting token **in memory only**. In Docker this needs a fixed callback port published to loopback so the container's login callback is reachable:
286+
287+
```json
288+
{
289+
"mcp": {
290+
"servers": {
291+
"github": {
292+
"command": "docker",
293+
"args": [
294+
"run",
295+
"-i",
296+
"--rm",
297+
"-p",
298+
"127.0.0.1:8085:8085",
299+
"-e",
300+
"GITHUB_OAUTH_CALLBACK_PORT",
301+
"ghcr.io/github/github-mcp-server"
302+
],
303+
"env": {
304+
"GITHUB_OAUTH_CALLBACK_PORT": "8085"
305+
}
306+
}
307+
}
308+
}
309+
}
310+
```
311+
312+
See **[Local Server OAuth Login](docs/oauth-login.md)** for the native-binary flow (no fixed port needed), the headless/device-code fallback, GitHub Enterprise Server / `ghe.com`, and bringing your own OAuth or GitHub App.
313+
314+
**Or authenticate with a Personal Access Token.** Set `GITHUB_PERSONAL_ACCESS_TOKEN` instead (it takes precedence over OAuth):
286315

287316
```json
288317
{

‎docs/installation-guides/install-antigravity.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,35 @@ Close and reopen Antigravity for the changes to take effect.
7575

7676
If you prefer running the server locally with Docker:
7777

78+
On github.com you can skip the token entirely: the server opens a browser login on first use and keeps the credential in memory only. In Docker, publish a fixed callback port to loopback:
79+
80+
```json
81+
{
82+
"mcpServers": {
83+
"github": {
84+
"command": "docker",
85+
"args": [
86+
"run",
87+
"-i",
88+
"--rm",
89+
"-p",
90+
"127.0.0.1:8085:8085",
91+
"-e",
92+
"GITHUB_OAUTH_CALLBACK_PORT",
93+
"ghcr.io/github/github-mcp-server"
94+
],
95+
"env": {
96+
"GITHUB_OAUTH_CALLBACK_PORT": "8085"
97+
}
98+
}
99+
}
100+
}
101+
```
102+
103+
See **[Local Server OAuth Login](../oauth-login.md)** for the native-binary flow (no fixed port), headless/device-code fallback, GitHub Enterprise, and bringing your own OAuth or GitHub App.
104+
105+
To authenticate with a Personal Access Token instead (it takes precedence over OAuth):
106+
78107
```json
79108
{
80109
"mcpServers": {

‎docs/installation-guides/install-claude.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,16 @@ claude mcp add-json github "{`"type`":`"http`",`"url`":`"https://api.githubcopil
6363
### Local Server Setup (Docker required)
6464

6565
### With Docker
66+
67+
On github.com you can skip the token entirely: the server opens a browser login on first use and keeps the credential in memory only. In Docker, publish a fixed callback port to loopback. Run the following command in the terminal (not in Claude Code CLI):
68+
69+
```bash
70+
claude mcp add github -e GITHUB_OAUTH_CALLBACK_PORT=8085 -- docker run -i --rm -p 127.0.0.1:8085:8085 -e GITHUB_OAUTH_CALLBACK_PORT ghcr.io/github/github-mcp-server
71+
```
72+
73+
See **[Local Server OAuth Login](../oauth-login.md)** for the native-binary flow (no fixed port), headless/device-code fallback, GitHub Enterprise, and bringing your own OAuth or GitHub App.
74+
75+
To authenticate with a Personal Access Token instead (it takes precedence over OAuth):
6676
1. Run the following command in the terminal (not in Claude Code CLI):
6777
```bash
6878
claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=YOUR_GITHUB_PAT -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server
@@ -136,6 +146,35 @@ claude mcp add github --transport http https://api.githubcopilot.com/mcp/ -H "Au
136146

137147
Add this codeblock to your `claude_desktop_config.json`:
138148

149+
On github.com you can skip the token entirely: the server opens a browser login on first use and keeps the credential in memory only. In Docker, publish a fixed callback port to loopback:
150+
151+
```json
152+
{
153+
"mcpServers": {
154+
"github": {
155+
"command": "docker",
156+
"args": [
157+
"run",
158+
"-i",
159+
"--rm",
160+
"-p",
161+
"127.0.0.1:8085:8085",
162+
"-e",
163+
"GITHUB_OAUTH_CALLBACK_PORT",
164+
"ghcr.io/github/github-mcp-server"
165+
],
166+
"env": {
167+
"GITHUB_OAUTH_CALLBACK_PORT": "8085"
168+
}
169+
}
170+
}
171+
}
172+
```
173+
174+
See **[Local Server OAuth Login](../oauth-login.md)** for the native-binary flow (no fixed port), headless/device-code fallback, GitHub Enterprise, and bringing your own OAuth or GitHub App.
175+
176+
To authenticate with a Personal Access Token instead (it takes precedence over OAuth):
177+
139178
```json
140179
{
141180
"mcpServers": {
@@ -212,6 +251,35 @@ Or open the file in a text editor and add the `mcpServers` block manually:
212251

213252
> **macOS note**: Xcode runs with a minimal `PATH` that typically excludes `/usr/local/bin` (Intel) and `/opt/homebrew/bin` (Apple Silicon). Use the full path to `docker` to ensure it can be found. Run `which docker` in Terminal to find the correct path on your system.
214253
254+
On github.com you can skip the token entirely: the server opens a browser login on first use and keeps the credential in memory only. In Docker, publish a fixed callback port to loopback:
255+
256+
```json
257+
{
258+
"mcpServers": {
259+
"github": {
260+
"command": "/usr/local/bin/docker",
261+
"args": [
262+
"run",
263+
"-i",
264+
"--rm",
265+
"-p",
266+
"127.0.0.1:8085:8085",
267+
"-e",
268+
"GITHUB_OAUTH_CALLBACK_PORT",
269+
"ghcr.io/github/github-mcp-server"
270+
],
271+
"env": {
272+
"GITHUB_OAUTH_CALLBACK_PORT": "8085"
273+
}
274+
}
275+
}
276+
}
277+
```
278+
279+
See **[Local Server OAuth Login](../oauth-login.md)** for the native-binary flow (no fixed port), headless/device-code fallback, GitHub Enterprise, and bringing your own OAuth or GitHub App.
280+
281+
To authenticate with a Personal Access Token instead (it takes precedence over OAuth):
282+
215283
```json
216284
{
217285
"mcpServers": {

‎docs/installation-guides/install-cline.md‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,32 @@ Replace `YOUR_GITHUB_PAT` with your [GitHub Personal Access Token](https://githu
2929
## Local Server (Docker)
3030

3131
1. Click the Cline icon in your editor's sidebar (or open the command palette and search for "Cline"), then click the **MCP Servers** icon (server stack icon at the top of the Cline panel), and click **"Configure MCP Servers"** to open `cline_mcp_settings.json`.
32-
2. Add the configuration below, replacing `YOUR_GITHUB_PAT` with your [GitHub Personal Access Token](https://github.com/settings/tokens).
32+
2. Add one of the configurations below. The OAuth option needs no token; for the PAT option, replace `YOUR_GITHUB_PAT` with your [GitHub Personal Access Token](https://github.com/settings/tokens).
33+
34+
On github.com you can skip the token entirely: the server opens a browser login on first use and keeps the credential in memory only. In Docker, publish a fixed callback port to loopback:
35+
36+
```json
37+
{
38+
"mcpServers": {
39+
"github": {
40+
"command": "docker",
41+
"args": [
42+
"run", "-i", "--rm",
43+
"-p", "127.0.0.1:8085:8085",
44+
"-e", "GITHUB_OAUTH_CALLBACK_PORT",
45+
"ghcr.io/github/github-mcp-server"
46+
],
47+
"env": {
48+
"GITHUB_OAUTH_CALLBACK_PORT": "8085"
49+
}
50+
}
51+
}
52+
}
53+
```
54+
55+
See **[Local Server OAuth Login](../oauth-login.md)** for the native-binary flow (no fixed port), headless/device-code fallback, GitHub Enterprise, and bringing your own OAuth or GitHub App.
56+
57+
To authenticate with a Personal Access Token instead (it takes precedence over OAuth):
3358

3459
```json
3560
{

‎docs/installation-guides/install-codex.md‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,27 @@ echo -e ".env" >> .gitignore
4545

4646
## Local Docker Configuration
4747

48-
Use this if you prefer a local, self-hosted instance instead of the remote HTTP server, please refer to the [OpenAI documentation for configuration](https://developers.openai.com/codex/mcp).
48+
Use this if you prefer a local, self-hosted instance instead of the remote HTTP server. See the [OpenAI documentation for configuration](https://developers.openai.com/codex/mcp) for the authoritative schema.
49+
50+
On github.com you can skip the token entirely: the server opens a browser login on first use and keeps the credential in memory only. In Docker, publish a fixed callback port to loopback:
51+
52+
```toml
53+
[mcp_servers.github]
54+
command = "docker"
55+
args = ["run", "-i", "--rm", "-p", "127.0.0.1:8085:8085", "-e", "GITHUB_OAUTH_CALLBACK_PORT", "ghcr.io/github/github-mcp-server"]
56+
env = { GITHUB_OAUTH_CALLBACK_PORT = "8085" }
57+
```
58+
59+
See **[Local Server OAuth Login](../oauth-login.md)** for the native-binary flow (no fixed port), headless/device-code fallback, GitHub Enterprise, and bringing your own OAuth or GitHub App.
60+
61+
To authenticate with a Personal Access Token instead (it takes precedence over OAuth):
62+
63+
```toml
64+
[mcp_servers.github]
65+
command = "docker"
66+
args = ["run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN", "ghcr.io/github/github-mcp-server"]
67+
env = { GITHUB_PERSONAL_ACCESS_TOKEN = "ghp_your_token_here" }
68+
```
4969

5070
## Verification
5171

‎docs/installation-guides/install-copilot-cli.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,35 @@ For additional options like toolsets and read-only mode, see the [remote server
9595

9696
With Docker running, you can run the GitHub MCP server in a container:
9797

98+
On github.com you can skip the token entirely: the server opens a browser login on first use and keeps the credential in memory only. In Docker, publish a fixed callback port to loopback:
99+
100+
```json
101+
{
102+
"mcpServers": {
103+
"github": {
104+
"command": "docker",
105+
"args": [
106+
"run",
107+
"-i",
108+
"--rm",
109+
"-p",
110+
"127.0.0.1:8085:8085",
111+
"-e",
112+
"GITHUB_OAUTH_CALLBACK_PORT",
113+
"ghcr.io/github/github-mcp-server"
114+
],
115+
"env": {
116+
"GITHUB_OAUTH_CALLBACK_PORT": "8085"
117+
}
118+
}
119+
}
120+
}
121+
```
122+
123+
See **[Local Server OAuth Login](../oauth-login.md)** for the native-binary flow (no fixed port), headless/device-code fallback, GitHub Enterprise, and bringing your own OAuth or GitHub App.
124+
125+
To authenticate with a Personal Access Token instead (it takes precedence over OAuth):
126+
98127
```json
99128
{
100129
"mcpServers": {

‎docs/installation-guides/install-cursor.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,35 @@ The local GitHub MCP server runs via Docker and requires Docker Desktop to be in
5151

5252
### Docker Configuration
5353

54+
On github.com you can skip the token entirely: the server opens a browser login on first use and keeps the credential in memory only. In Docker, publish a fixed callback port to loopback:
55+
56+
```json
57+
{
58+
"mcpServers": {
59+
"github": {
60+
"command": "docker",
61+
"args": [
62+
"run",
63+
"-i",
64+
"--rm",
65+
"-p",
66+
"127.0.0.1:8085:8085",
67+
"-e",
68+
"GITHUB_OAUTH_CALLBACK_PORT",
69+
"ghcr.io/github/github-mcp-server"
70+
],
71+
"env": {
72+
"GITHUB_OAUTH_CALLBACK_PORT": "8085"
73+
}
74+
}
75+
}
76+
}
77+
```
78+
79+
See **[Local Server OAuth Login](../oauth-login.md)** for the native-binary flow (no fixed port), headless/device-code fallback, GitHub Enterprise, and bringing your own OAuth or GitHub App.
80+
81+
To authenticate with a Personal Access Token instead (it takes precedence over OAuth):
82+
5483
```json
5584
{
5685
"mcpServers": {

‎docs/installation-guides/install-gemini-cli.md‎

Lines changed: 33 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,37 @@ You can also connect to the hosted MCP server directly. After securely storing y
5959

6060
### Method 3: Local Docker
6161

62-
With docker running, you can run the GitHub MCP server in a container:
62+
With docker running, you can run the GitHub MCP server in a container.
63+
64+
On github.com you can skip the token entirely: the server opens a browser login on first use and keeps the credential in memory only. In Docker, publish a fixed callback port to loopback:
65+
66+
```json
67+
// ~/.gemini/settings.json
68+
{
69+
"mcpServers": {
70+
"github": {
71+
"command": "docker",
72+
"args": [
73+
"run",
74+
"-i",
75+
"--rm",
76+
"-p",
77+
"127.0.0.1:8085:8085",
78+
"-e",
79+
"GITHUB_OAUTH_CALLBACK_PORT",
80+
"ghcr.io/github/github-mcp-server"
81+
],
82+
"env": {
83+
"GITHUB_OAUTH_CALLBACK_PORT": "8085"
84+
}
85+
}
86+
}
87+
}
88+
```
89+
90+
See **[Local Server OAuth Login](../oauth-login.md)** for the native-binary flow (no fixed port), headless/device-code fallback, GitHub Enterprise, and bringing your own OAuth or GitHub App.
91+
92+
To authenticate with a Personal Access Token instead (it takes precedence over OAuth):
6393

6494
```json
6595
// ~/.gemini/settings.json
@@ -104,6 +134,8 @@ Then, replacing `/path/to/binary` with the actual path to your binary, configure
104134
}
105135
```
106136

137+
To log in with OAuth instead of a PAT (no token to create or store), omit `GITHUB_PERSONAL_ACCESS_TOKEN` — the native binary uses a random loopback callback port, so no extra configuration is needed. See **[Local Server OAuth Login](../oauth-login.md)**.
138+
107139
## Verification
108140

109141
To verify that the GitHub MCP server has been configured, start Gemini CLI in your terminal with `gemini`, then:

‎docs/installation-guides/install-opencode.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,33 @@ Set `GITHUB_PERSONAL_ACCESS_TOKEN` in your shell environment before starting Ope
6161

6262
The local GitHub MCP server runs via Docker and requires Docker Desktop (or another Docker runtime) to be installed and running.
6363

64+
On github.com you can skip the token entirely: the server opens a browser login on first use and keeps the credential in memory only. In Docker, publish a fixed callback port to loopback:
65+
66+
```json
67+
{
68+
"$schema": "https://opencode.ai/config.json",
69+
"mcp": {
70+
"github": {
71+
"type": "local",
72+
"command": [
73+
"docker", "run", "-i", "--rm",
74+
"-p", "127.0.0.1:8085:8085",
75+
"-e", "GITHUB_OAUTH_CALLBACK_PORT",
76+
"ghcr.io/github/github-mcp-server"
77+
],
78+
"enabled": true,
79+
"environment": {
80+
"GITHUB_OAUTH_CALLBACK_PORT": "8085"
81+
}
82+
}
83+
}
84+
}
85+
```
86+
87+
See **[Local Server OAuth Login](../oauth-login.md)** for the native-binary flow (no fixed port), headless/device-code fallback, GitHub Enterprise, and bringing your own OAuth or GitHub App.
88+
89+
To authenticate with a Personal Access Token instead (it takes precedence over OAuth):
90+
6491
```json
6592
{
6693
"$schema": "https://opencode.ai/config.json",

0 commit comments

Comments
 (0)