Connect the GitHub API to Claude with an MCP server

Connecting GitHub to your AI client turns "what's open on the payments repo?" into a question you can just ask. In this recipe you'll expose the GitHub REST API as an MCP server — reading issues, pull requests, and code search — using a fine-grained personal access token kept safely on the server side.

1. Create a fine-grained personal access token

In GitHub, go to Settings → Developer settings → Personal access tokens → Fine-grained tokens. Limit it to the specific repositories you want, and grant read-only permissions (for example, read access to Issues, Pull requests, and Contents). Copy the token — it starts with github_pat_.

2. Create a workspace and upload GitHub's spec

GitHub publishes its full REST API as an OpenAPI description. Create a workspace, open the Upload tab, and provide the spec by URL or file. Because the spec is large, tool generation may take a moment.

3. Configure auth — Bearer Token

GitHub expects Authorization: Bearer github_pat_…. On the Configure tab, choose Bearer Token, set the API base URL to https://api.github.com, and paste your token.

4. Enable the read tools you want

GitHub's API has hundreds of operations. Don't expose them all — pick the handful that match your use case and leave write operations off:

5. Get your MCP URL

Open the Connect tab and copy the snippet. Cast injects your GitHub token on every upstream call, so your client only needs the URL.

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote@latest",
        "https://mcp.getcast.io/github-cmpgh77231"
      ]
    }
  }
}

Try it

"List the 10 most recently updated open issues on acme/payments."
"Summarize the open pull requests on acme/web and who they're assigned to."
"Search our org's code for usages of the deprecated 'legacyCharge' function."

6. Watch sessions, then grow the toolset

Once your team connects, Cast tracks each connection as a session — transport, geography, duration, and how many tools it called — so you can see real usage instead of guessing:

Cast also mines the sequences of tools agents call across sessions. Strong patterns show what your team relies on; gaps show where they keep reaching for a capability you haven't enabled:

The pattern view makes the next move obvious: agents keep trying to read issue comments after opening an issue, but listComments isn't enabled. Toggle it on in Configure, and you've grown the server in response to actual demand. This is the loop — launch a focused toolset, watch the sessions, add what people reach for.

Production checklist

• Scope the token to specific repos and read-only permissions.
• Keep createIssue, deleteRepo, and other writes disabled until needed.
• Be mindful of GitHub's rate limits — enable Cast's rate limiting for busy agents.
• Check the Logs and Patterns tabs to confirm what's called and what to add next.

Frequently asked questions