How to connect VS Code Copilot to GitHub with the official GitHub MCP Server

VS Code's Copilot in the Visual Studio Code editor can read files that are currently open. However, it lacks the ability to access information such as open issues, review comments on pull requests, or the output of recent GitHub Actions runs. To bridge this gap, GitHub provides the MCP Server, an official bridge between AI tools and the GitHub platform.

Once connected, the agent can browse code across accessible repositories, create and update issues and pull requests, examine workflow runs and build failures, and view security findings and Dependabot alerts all through chat prompts. The server is hosted remotely, so there is no need for any installation or running on VS Code. This guide covers the setup process, limitations, and alternative local options if desired.

To get started, you will need VS Code version 1.101 or later, which is required for remote MCP and OAuth functionality. Ensure you have GitHub Copilot installed in VS Code, with Agent mode enabled. If you are part of an organization, any MCP policies set by your administrators will apply.

There are two options for connecting Copilot to GitHub:

Option 1: One-click setup

The README file on GitHub contains an Install in VS Code button. By clicking this button, the setup process will be initiated automatically. After completing the flow, toggle Agent mode next to the Copilot Chat input. This will start the server. For remote servers, VS Code 1.101+ supports OAuth sign-in using your GitHub account instead of creating a token.

Option 2: Manual setup

Alternatively, you can manually add the server configuration by opening or creating the .vscode/mcp.json file in your project. Add the following JSON to the file:

{

"servers": {

"github": {

"type": "http",

"url": "https://api.githubcopilot.com/mcp/"

}

}

}

This setup uses OAuth. If you prefer to use a GitHub personal access token instead, the README prompt will ask for it as a password input instead of hard-coding it in the file:

{

"servers": {

"github": {

"type": "http",

"url": "https://api.githubcopilot.com/mcp/",

"headers": {

"Authorization": "Bearer ${input:github_mcp_pat}"

}

}

},

"inputs": [

{

"type": "promptString",

"id": "github_mcp_pat",

"description": "GitHub Personal Access Token",

"password": true

}

]

}

You have several options to limit the agent's capabilities and ensure it only uses necessary tools. By default, the server enables five toolsets: context, repos, issues, pull_requests, and users. To keep the context smaller and improve the model's performance, enable only the required toolsets. Other available toolsets include actions, code_security, dependabot, discussions, notifications, projects, and more. You can control which toolsets are enabled through the URL or headers.

For read-only access, add /readonly to the URL to restrict the agent to read-only operations. To enable only specific toolsets, use the /x/{toolset} path or the X-MCP-Toolsets header. To combine multiple toolsets, use the X-MCP-Toolsets header with multiple comma-separated values. To enable read-only mode and experiment with newer tools, use the /x/all path with the X-MCP-Readonly and X-MCP-Insiders headers.

If your agent reads issues and pull requests on a public repository, anyone can potentially write content that the agent will see. To mitigate this risk, use the lockdown mode, which can be activated by including the X-MCP-Lockdown: true header. While this mode provides a best-effort filter, it is not a security boundary, and it does not change what your token can read or write. Pair it with read-only mode and a token scoped to the minimum required permissions.

For those who prefer to run the server locally, you can use Docker. On GitHub.com, the one-click Docker buttons will log you in with OAuth on first use. If you have a personal access token, the README contains instructions for running the server with a personal access token, read-only mode, and additional toolsets. The same image can also be used with Claude Code.

The repository provides installation guides for other Integrated Development Environments (IDEs) such as Cursor, Claude Desktop, Codex, Windsurf, Zed, and Copilot in JetBrains, Visual Studio, Eclipse, and Xcode.

Lastly, GitHub recommends careful token management. Only grant the necessary scopes, use separate tokens per project, rotate tokens regularly, never commit them (keep them in environment variables or .env files), and restrict permissions on configuration files containing them. For more detailed information and further use cases, refer to the GitHub MCP Server page on Deduped. GitHub is typically the first MCP server that users integrate, but it is not the last, as there are numerous other options available.