GitHub
Connect GitHub to read and edit code, review and merge pull requests, manage issues and projects, and run and debug Actions workflows.
You paste one value into PopMCP: a GitHub personal access token, either a classic token starting with ghp_ (the link on the connect form pre-ticks its scopes) or a fine-grained token starting with github_pat_.
- Setup time
- 3 min
- Auth
- API credentials
- API base URL
- https://api.github.com
- Rate limits
- A personal access token gets 5,000 REST requests an hour. Secondary limits also apply: at most 100 concurrent requests, 900 points a minute on REST (most reads cost 1, most writes 5) and about 80 content-creating requests a minute. Over a limit GitHub answers 403 or 429.
Before you begin
- A GitHub account with a verified email address, since GitHub asks for one before it issues a token
- Access to the repositories and organizations you want the MCP to reach. A token can never see more than your own account can
- For organizations that use SAML single sign-on, an active SSO session so you can authorize a classic token for that organization
- A decision on classic or fine-grained: classic reaches every repository you can open, fine-grained reaches one owner and the repositories you pick
Get your credentials
Open GitHub's token page from the PopMCP form
Sign in to GitHub, then click the link under Personal access token on the PopMCP connect form. It opens New personal access token (classic) with the note PopMCP and the recommended scopes already ticked. To get there by hand: your profile picture, Settings, Developer settings, Personal access tokens, Tokens (classic), then Generate new token and Generate new token (classic).
New personal access token (classic)
Personal access tokens (classic) function like ordinary OAuth access tokens.
The link ticks eight scopes. Nothing that deletes a repository or administers an organization is ticked; add delete_repo or admin:org only if you want those tools to work.
Choose an expiry and generate the token
Under Expiration, pick how long the token should last, or Custom for a date. When it expires the connection stops working and you paste a new token, so choose a period you are comfortable renewing. Leave the ticked scopes as they are and click Generate token at the bottom of the page.
New personal access token (classic)
Personal access tokens (classic) function like ordinary OAuth access tokens.
- repo
- Full control of private repositories
- workflow
- Update GitHub Action workflows
- project
- Full control of projects
- read:org
- Read org and team membership
GitHub removes a token that has not been used for a year, whatever its expiry.
Copy the token while it is on screen
GitHub shows the new token once, at the top of Tokens (classic). Click the copy icon next to it. The value starts with ghp_.
Personal access tokens (classic)
Tokens you have generated that can be used to access the GitHub API.
| Note | Scopes | Expires | Last used |
|---|---|---|---|
| PopMCPCreated today | repo, workflow, project, gist, read:org, notifications, read:user, user:email | In 90 days | Never used |
Lost it before copying? Delete the token and generate a new one; GitHub cannot show it again.
Or create a fine-grained token for chosen repositories
If you want the MCP limited to particular repositories, open Fine-grained tokens and click Generate new token instead. Enter a Token name, pick the Resource owner (you or one organization) and an Expiration, set Repository access to Only select repositories and pick them. Under Permissions, give Read and write to the repository permissions the tools need, such as Contents, Issues, Pull requests, Actions and Workflows, then click Generate token and copy the github_pat_ value.
New fine-grained personal access token
Create a fine-grained, repository-scoped token suitable for personal API use.
Fine-grained tokens cannot call the Checks API, read Packages, reach user-owned Projects or span several organizations. If the organization requires approval, the token reads only public data until an owner approves it.
Authorize a classic token for SAML single sign-on, if your organization uses it
Back on Tokens (classic), click Configure SSO next to the token and click Authorize beside each organization the MCP should reach. Skip this for personal repositories and for fine-grained tokens, which are authorized when you create them.
Personal access tokens (classic)
Tokens you have generated that can be used to access the GitHub API.
| Note | Scopes | Expires | |
|---|---|---|---|
| PopMCPLast used within the last week | repo, workflow, project, read:org | In 90 days | Configure SSO |
Until the token is authorized, GitHub refuses that organization's repositories even though your account can open them.
Paste the token into PopMCP
In PopMCP, paste the token into Personal access token and connect. PopMCP checks it against GitHub straight away and labels the connection with your GitHub login.
Connect in PopMCP
Open your workspace, choose GitHub in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Personal access tokensecret | Open the link below: it takes you to GitHub's token page with the right permissions already ticked. Press Generate token, copy it and paste it here. Fine-grained tokens (github_pat_) work too if you want to limit access to chosen repositories. Stored encrypted.Encrypted with AES-256-GCM on save and never shown again. |
PopMCP verifies the credential against GitHub immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Verify it worked
PopMCP marks the GitHub connection Verified and labels it with your login, such as @octo-dana. Asking the AI to list your repositories, or the open pull requests in one of them, returns real results.
Troubleshooting
"GitHub rejected this token. It may be mistyped, expired or revoked."
Why: The token was copied incompletely, has passed its expiry date, or was deleted on GitHub.
Fix: Generate a new token from the link on the PopMCP form and paste the whole value, with no `Bearer` prefix or quotes.
"That does not look like a GitHub token."
Why: Something other than a personal access token was pasted, such as an OAuth app's client secret, an SSH key or a GitLab token.
Fix: Paste a classic token (`ghp_`) or a fine-grained token (`github_pat_`) from **Developer settings**, **Personal access tokens**.
Your organization's repositories return 403 or 404 while personal ones work
Why: The organization enforces SAML single sign-on and the classic token is not authorized for it, or the organization blocks classic tokens. GitHub answers 404 for anything a token cannot see.
Fix: On **Tokens (classic)**, click **Configure SSO** and **Authorize** the organization. If the organization blocks classic tokens, create a fine-grained token with that organization as **Resource owner**.
A fine-grained token only reads public data in an organization
Why: The organization requires approval for fine-grained tokens, and the token is still pending.
Fix: Ask an organization owner to approve the request under the organization's personal access token settings. Until then the token can only read public resources.
Check runs, packages or your personal projects fail with a fine-grained token
Why: GitHub does not let fine-grained tokens call the Checks API, read Packages or reach user-owned Projects.
Fix: Connect a classic token instead if you need checks_list_for_ref, the packages_ tools or projects owned by your user account.
Editing a file under .github/workflows is refused
Why: The token lacks the workflow scope (classic) or the Workflows permission (fine-grained).
Fix: Create a new token with workflow ticked, or add the Workflows permission to the fine-grained token, and reconnect.
"GitHub is rate limiting this token right now."
Why: The token used up its 5,000 requests for the hour, or hit a secondary limit such as too many writes in a minute.
Fix: Wait for the hourly window to reset (GitHub reports it in the `x-ratelimit-reset` header), then ask for fewer or smaller pages.