GitHub MCP server tools: which toolsets to turn on
Updated By Agent Radar4 min read
Short answer
GitHub's MCP server lists 92 tools in 22 toolsets and loads 45 by default. What each toolset does, what to add, and two servers that fill the gaps.
Top pick: GitHub MCP server. GitHub's own server for repositories, issues, pull requests, Actions, security alerts and Projects, through the GitHub API.
Quick comparison
| Pick | License | Pricing | Source |
|---|---|---|---|
| 1.GitHub MCP server | Open source | Not stated | GitHub MCP server README |
| 2.MCP reference Git server (mcp-server-git) | Open source | Not stated | mcp-server-git README |
| 3.Playwright MCP | Open source | Not stated | Playwright MCP repository |
Start with the defaults and add one toolset per job. With no flags, the GitHub MCP server loads five toolsets (context, repos, issues, pull_requests and users), which is 45 of the 92 tools its README lists. That covers reading code, opening and reviewing pull requests and working issues. Turning on all gives the model twice as many tools to choose from, and the README itself says fewer toolsets help tool choice and save context.
Counts below come from the repository README on November 4, 2026, the day after version 2.1.0. Tool names move between releases, so recheck before you pin a list.
The toolsets, grouped by job
| Job | Toolsets | Tools | Turn on when |
|---|---|---|---|
| Default coding loop | context, repos, issues, pull_requests, users | 45 | Always; this is what loads with no flags |
| CI | actions | 4 | The agent should read job logs or rerun workflows |
| Security triage | code_security, secret_protection, dependabot, security_advisories, code_quality | 11 | You want alert lists and details in the chat |
| Planning | projects, labels, discussions | 11 | The agent grooms boards or answers discussions |
| Inbox | notifications | 6 | You want "what needs me today" summaries |
| Org admin | governance, orgs | 5 | Someone trusted manages rulesets and custom properties |
| Odds and ends | gists, git, stargazers, copilot, copilot_issue_intents | 11 | A specific workflow needs them |
The planning row counts projects (3), labels (3, one shared with issues) and discussions (5).
What sits in the default 45
- context (4):
get_me,get_teams,get_team_membersandui_get. The README marks this toolset as strongly recommended, since it tells the model who it is acting as. - repos (20): file reads with
get_file_contents,search_code, commits, branches, tags and releases, plus writes such ascreate_or_update_file,push_files,create_branch,fork_repository,delete_fileanddelete_repository. - issues (10):
issue_read,issue_write,list_issues,search_issues, comments, issue types and fields, andsub_issue_write. - pull_requests (10):
create_pull_request,pull_request_read,pull_request_review_write, review comments,update_pull_request_branchandmerge_pull_request. - users (1):
search_users.
Note that the default set can delete files and whole repositories. If the agent only needs to read, start with --read-only and add write access for a narrower token later.
Three setups worth copying
| Setup | Flags | Why |
|---|---|---|
| Code reviewer on public repos | --toolsets default --read-only --lockdown-mode | Reads diffs and comments but cannot write, and filters text from outsiders |
| CI fixer | --toolsets default,actions | Adds get_job_logs and actions_run_trigger to the usual loop |
| Security digest | --toolsets context,code_security,secret_protection,dependabot --read-only | Alert lists only, no repository writes |
Lockdown mode changes specific calls: issue_read:get and four pull_request_read methods return an error when the author lacks push access, and comment and review lists drop those authors' entries. Private repositories are not affected.
New in 2.1.0: issue artifacts
Version 2.1.0 adds issue_artifact_read and issue_artifact_write for plans and references stored on an issue. They are hidden unless you enable the issue_artifacts feature flag, and lockdown mode blocks them entirely. Details are in the 2.1.0 release note.
What the GitHub server does not cover
It talks to the GitHub API, so it cannot see your uncommitted changes. For that, the reference Git server offers 12 local tools including git_diff_staged and git_commit. It also cannot look at a running page; Playwright MCP can open a preview deploy and click through it. For a wider look at GitHub's server against the reference collection, see GitHub MCP vs reference MCP servers.
The picks
GitHub's own server for repositories, issues, pull requests, Actions, security alerts and Projects, through the GitHub API.
Pros
- Toolsets, single-tool lists and read-only mode let you cut the tool list down to the job.
- Lockdown mode filters public-repo content from people without push access.
Cons
- Every call goes through the GitHub API with your token, so it does not see uncommitted local changes.
- Loading all 92 tools makes tool choice harder for the model and fills context.
A local server from the MCP reference collection with 12 git tools, from git_status and git_diff to git_commit and git_checkout.
Pros
- Works on the local working tree, including staged and unstaged diffs.
- No GitHub token needed.
Cons
- No issues, pull requests, Actions or alerts.
- The reference collection is meant as examples, so check its maintenance status before relying on it.
Microsoft's server that drives a real browser through accessibility snapshots, useful for checking a pull request's preview deploy.
Pros
- Lets the agent open and test the page a pull request changes.
- Apache-2.0 and runs locally with npx.
Cons
- Knows nothing about GitHub objects; it only sees web pages.
- Adds a browser to the agent's attack surface, so keep it off untrusted sites.
Questions
How many tools does the GitHub MCP server have?
The local server's README lists 92 distinct tools in 22 toolsets as of November 4, 2026. The default configuration loads 45 of them. The remote server adds three more toolsets: copilot, copilot_spaces and github_support_docs_search.
How do I run the GitHub MCP server read only?
Start it with --read-only, or set GITHUB_READ_ONLY=1 in Docker. Write tools are then skipped even if you name them in --tools.
What does lockdown mode do?
On public repositories it hides or refuses issue and pull request content written by users without push access, to reduce prompt injection. The README says it is a best-effort filter, not an authorization boundary, and content from github-actions[bot] and copilot is always allowed.
Can I add one tool without a whole toolset?
Yes. --tools takes exact tool names and adds to any toolsets you chose, for example --toolsets repos,issues --tools get_gist. A misspelled tool name stops the server at startup.