Skip to content
Status

GitHub

Connect GitHub so users can work with repositories and other resources their GitHub account is permitted to access through GitHub's hosted MCP server.

Before you begin, obtain:

  • Administrative access to the GitHub organization that will own the OAuth app.
  • Standard GitHub.com hosting for the target organization. This Setup Guide does not cover GitHub Enterprise Cloud with data residency or GitHub Enterprise Server.
  • The organization-approved public URL for this connection from the application or cloud security owner.
  • If the target organization restricts OAuth apps, access to an organization owner who can grant access — see Connect your credentials.
  • A valid organization SSO session if the target organization protects resources with SSO enforcement.

Sign in at github.com.

Open organization developer settings

  1. Click your profile picture in the upper-right corner.
  2. Click Your organizations.
  3. To the right of the organization that should own the app, click Settings.
  4. In the left sidebar, click Developer settings.
  5. Click OAuth apps.

Register the OAuth app

GitHub makes OAuth app registration details public. Do not put internal URLs or sensitive details in the registration fields.

If the page shows New OAuth App, click it. If the page instead shows Register a new application, click it.

  1. In Application name, enter a recognizable public name, such as Speakeasy AI Control Plane – GitHub MCP.

  2. In Homepage URL, enter the full organization-approved public URL.

  3. Optionally, enter a public-safe Application description.

  4. In Authorization callback URL, enter this value:

    https://ai.speakeasy.com/mcp/remote_login_callback

  5. Leave Enable Device Flow off.

  6. Click Register application. This opens the app’s settings page.

If the target organization restricts OAuth apps, complete the organization approval flow after saving credentials in Connect your credentials.

Generate the OAuth credentials

  1. On the app’s settings page, copy the value next to Client ID into an approved password manager.
  2. Under Client secrets, click Generate a new client secret.
  3. Copy the generated client secret into the approved password manager. Do not put it in source control or this Guide.

If no usable secret is available before the first connection, return to this page and click Generate a new client secret.

Add the server in Speakeasy

  1. In the Speakeasy AI Control Plane sidebar, under MCP Gateway, select MCP.
  2. Click Add new to open Add MCP server.
  3. Choose From the catalog.
  4. On the MCP Catalog page, find GitHub using Search MCP servers….
  5. Open its entry and click Add.
  6. In the Add to Project dialog, under Identity, select User Identity. The dialog may preselect No Identity.
  7. Click Add to Project. If the dialog offers a Guardrails step, finish it or click Skip for now.

GitHub needs a client registered by hand, so the result says to finish setup in Settings > Identity, and the server stays Disabled for now. This is expected. Click Finish setup on the server’s result to open its Settings.

Connect your credentials

In the server’s Settings, find the Identity section.

  1. Select User Identity.

  2. In Choose an identity provider, confirm the provider is https://github.com/login/oauth. It may be badged Will be created. If no provider or a different one is selected, open the picker, search for github.com in Search identity providers…, and choose the github.com/login/oauth provider.

  3. Under the provider, choose Manual.

  4. Paste the Client ID from Generate the OAuth credentials into Client ID.

  5. Paste the client secret from Generate the OAuth credentials into Client secret. GitHub requires it, even though the field shows “Optional”.

  6. Open Advanced and enter the scopes users may grant in Scope, on one line. Start from the full list GitHub’s server advertises and delete any your organization does not allow:

    repo read:org read:user user:email read:packages write:packages read:project project gist notifications

    A blank Scope requests every scope in this list, including repo, write:packages, and gist.

  7. Click Save.

This section does not show the redirect URI. GitHub accepts the connection only if Register the OAuth app set Authorization callback URL to https://ai.speakeasy.com/mcp/remote_login_callback.

Then turn the server on:

  1. In Settings, open Danger Zone.
  2. Under Server Availability, turn on Enable MCP server so it shows Enabled.

If the target organization restricts OAuth apps, have a user authorize the connection, then complete the following:

  1. Have the user click their profile picture.
  2. Have the user click Settings.
  3. Under Integrations, have the user click Applications.
  4. Have the user click Authorized OAuth Apps.
  5. Have the user open this OAuth app.
  6. Next to the target organization, have the user click Request access.
  7. Have the user click Request approval from owners.

Then have an organization owner approve the pending request:

  1. Click the profile picture.
  2. Click Organizations.
  3. Select the target organization.
  4. Under the organization name, click Settings.
  5. Under Third-party Access, click OAuth app policy.
  6. Next to the app, click Review.
  7. Click Grant access.

If the user’s first authorization attempt was blocked before approval, have the user retry it after access is granted.

This guide covers setup only. For anything beyond it — billing, tool behavior, limits — see GitHub’s MCP documentation.