# GitHub MCP Server — 203 tools via DADL

The GitHub DADL turns GitHub's API into an MCP server that Claude, GPT or any MCP-compatible agent can consume directly. One YAML file declares all 203 tools — repo, issue, org, pull, team, workflow, and more — and ToolMesh serves them at runtime. No Python boilerplate, no per-endpoint code, no separate MCP server process.

Below: the endpoint coverage matrix, a two-block ToolMesh setup, the full tool reference grouped by GitHub feature area, required credential scopes.

**Source:** [GitHub REST API v3](https://docs.github.com/en/rest)

**Updated:** 2026-04-02

**Tags:** version-control, ci-cd, issue-tracking, automation, crud, webhooks, auth:bearer

## Which GitHub endpoints are covered?

**23%** (205 of ~900 endpoints).

**Focus:** repos (full CRUD + fork + collaborators + topics), orgs (members + teams), issues (full CRUD + comments + events + reactions), PRs (full CRUD + merge + reviews + review comments + requested reviewers), commits, branches (+ protection), git refs + objects (blobs, trees, commits), file management, labels, milestones, search (code + issues + repos + users + commits), releases (full CRUD), actions (workflows + runs + jobs + logs + secrets + artifacts + dispatch), users, tags, webhooks, deployments (+ statuses), environments, gists (full CRUD), notifications, check runs/suites, commit statuses, starring, watching, pages, code scanning, dependabot, secret scanning, packages (org + user: list, get, delete, restore, versions)

**Missing:** projects v2, codespaces, copilot, security advisories, rate limit API, git LFS, autolinks, repository rulesets

*Last reviewed: 2026-04-02*

## How do you configure the GitHub DADL?

1. Navigate to GitHub → Settings → Developer settings → Personal access tokens → Tokens (classic)
2. Click 'Generate new token (classic)'
3. Select scopes: repo (full access), read:org (list organizations), workflow (actions), admin:repo_hook (webhooks), delete_repo (delete repos), gist, notifications, read:packages, write:packages, delete:packages
4. Copy the token (starts with ghp_ or github_pat_)

**Environment variable:** `CREDENTIAL_GITHUB_TOKEN`

[Authentication docs](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens)

## How do you install the GitHub MCP server with ToolMesh?

Add to your `backends.yaml`:

```yaml
- name: github
  transport: rest
  dadl: github.dadl
  url: "https://api.github.com"

```

Set the credential:

```
CREDENTIAL_GITHUB_TOKEN=your-token-here
```

## What 203 tools does the GitHub DADL expose?

- **POST** `create_repo` — Create a new repository for the authenticated user. Set private=true for a private repo. auto_init=true creates an initial commit with a README.
- **POST** `create_org_repo` — Create a new repository in an organization. Requires org admin or repo creation permissions.
- **POST** `create_repo_from_template` — Create a new repository from a template. The template must have is_template=true.
- **GET** `list_user_repos` — List repositories for the authenticated user. Use type to filter (owner, member, all).
- **GET** `list_user_repos_by_username` — List public repositories for a specific user.
- **GET** `get_repo` — Get a single repository by owner and name.
- **PATCH** `update_repo` — Update repository settings. Only include fields you want to change. Use for description, homepage, visibility, merge settings, etc.
- **DELETE** `delete_repo` — Delete a repository. Requires delete_repo scope. This action is irreversible.
- **PUT** `replace_topics` — Replace all repository topics. Provide the full list of desired topics.
- **GET** `list_repo_languages` — List languages for a repository. Returns a map of language name to bytes of code.
- **GET** `list_repo_contributors` — List contributors to a repository, sorted by number of commits.
- **GET** `get_readme` — Get the README file for a repository. Content is base64 encoded.
- **GET** `list_forks` — List forks of a repository.
- **POST** `create_fork` — Fork a repository. Optionally specify an organization to fork into. Forking is asynchronous — poll get_repo to check when complete.
- **GET** `list_collaborators` — List collaborators for a repository. Affiliation: outside, direct, all.
- **GET** `check_collaborator` — Check if a user is a collaborator. Returns 204 if yes, 404 if no.
- **PUT** `add_collaborator` — Add a collaborator to a repository. Permission: pull, triage, push, maintain, admin.
- **DELETE** `remove_collaborator` — Remove a collaborator from a repository.
- **GET** `list_orgs` — List organizations the authenticated user belongs to.
- **GET** `get_org` — Get an organization by name, including member count, repo count, and billing info.
- **GET** `list_org_repos` — List repositories for an organization. Use list_orgs first to find org names.
- **GET** `list_org_members` — List members of an organization. Filter by role: all, admin, member.
- **GET** `list_org_teams` — List teams in an organization.
- **GET** `get_team` — Get a team by its slug (URL-friendly name).
- **POST** `create_team` — Create a team in an organization. Privacy: secret (visible to org members) or closed (visible to org members, searchable).
- **PATCH** `update_team` — Update a team. Only include fields you want to change.
- **DELETE** `delete_team` — Delete a team from an organization.
- **GET** `list_team_members` — List members of a team. Role filter: all, member, maintainer.
- **PUT** `add_team_member` — Add or update a team member. Role: member or maintainer.
- **DELETE** `remove_team_member` — Remove a member from a team.
- **GET** `list_team_repos` — List repositories a team has access to.
- **PUT** `add_team_repo` — Add a repository to a team. Permission: pull, triage, push, maintain, admin.
- **DELETE** `remove_team_repo` — Remove a repository from a team.
- **GET** `list_issues` — List issues for a repository. Also returns PRs unless filtered. State: open, closed, all. Note: GitHub treats PRs as issues — check for pull_request field to distinguish.
- **GET** `get_issue` — Get a single issue by number, including body, labels, assignees, and milestone.
- **POST** `create_issue` — Create a new issue. Labels are an array of label name strings.
- **PATCH** `update_issue` — Update an issue. Set state to 'closed' to close it. Only include fields you want to change.
- **PUT** `lock_issue` — Lock an issue. Lock reason: off-topic, too heated, resolved, spam.
- **DELETE** `unlock_issue` — Unlock an issue.
- **GET** `list_issue_comments` — List comments on an issue or pull request.
- **POST** `create_issue_comment` — Add a comment to an issue or pull request. Body supports GitHub-Flavored Markdown.
- **PATCH** `update_issue_comment` — Update an issue comment.
- **DELETE** `delete_issue_comment` — Delete an issue comment.
- **GET** `list_issue_events` — List events for an issue (labeled, assigned, closed, reopened, etc.).
- **GET** `list_issue_assignees` — List available assignees for issues in a repository (users with push access).
- **GET** `list_issue_reactions` — List reactions on an issue. Content: +1, -1, laugh, confused, heart, hooray, rocket, eyes.
- **POST** `create_issue_reaction` — Create a reaction on an issue. Content: +1, -1, laugh, confused, heart, hooray, rocket, eyes.
- **POST** `create_issue_comment_reaction` — Create a reaction on an issue comment.
- **GET** `list_pulls` — List pull requests for a repository. State: open, closed, all.
- **GET** `get_pull` — Get a single pull request including diff stats, mergeable state, and review status.
- **GET** `list_pull_files` — List files changed in a pull request with patch diffs and stats.
- **GET** `list_pull_reviews` — List reviews on a pull request (approved, changes_requested, commented).
- **POST** `create_pull` — Create a new pull request. head is the branch with changes, base is the target branch (e.g. main). Set draft=true to create a draft PR.
- **PATCH** `update_pull` — Update a pull request. Set state to 'closed' to close it. Only include fields you want to change.
- **PUT** `merge_pull` — Merge a pull request. merge_method: merge, squash, or rebase. Optionally provide sha to ensure merging the expected head commit.
- **GET** `list_pull_commits` — List commits on a pull request, ordered chronologically.
- **POST** `create_pull_review` — Create a review on a pull request. event: APPROVE, REQUEST_CHANGES, or COMMENT. Body is the review summary.
- **GET** `list_pull_review_comments` — List review comments on a pull request (inline code comments, not issue comments).
- **POST** `create_pull_review_comment` — Create an inline review comment on a pull request. Specify path and line (or start_line + line for multi-line). side: LEFT or RIGHT for diff side.
- **GET** `list_requested_reviewers` — List users and teams requested to review a pull request.
- **POST** `request_reviewers` — Request review from users or teams on a pull request.
- **DELETE** `remove_requested_reviewers` — Remove requested reviewers from a pull request.
- **GET** `list_commits` — List commits on a repository. Filter by sha (branch), path, author, or date range.
- **GET** `get_commit` — Get a single commit by SHA or ref, including full diff stats and file changes.
- **GET** `compare_commits` — Compare two commits. basehead format: 'base...head' (e.g. 'main...feature-branch'). Returns diff stats, commits, and file changes.
- **GET** `list_branches` — List branches for a repository.
- **GET** `get_branch` — Get a single branch including its latest commit SHA and protection status.
- **GET** `get_branch_protection` — Get branch protection rules for a branch.
- **PUT** `update_branch_protection` — Update branch protection rules. Set required_status_checks, enforce_admins, required_pull_request_reviews, and restrictions.
- **DELETE** `delete_branch_protection` — Delete branch protection rules for a branch.
- **POST** `create_ref` — Create a git reference (branch or tag). For branches use ref='refs/heads/branch-name'. sha is the commit to point to.
- **PATCH** `update_ref` — Update a git reference to point to a new SHA. ref is without 'refs/' prefix (e.g. 'heads/main'). Set force=true to do a non-fast-forward update.
- **DELETE** `delete_ref` — Delete a git reference. For branches use ref='heads/branch-name' (without refs/ prefix). For tags use ref='tags/tag-name'.
- **GET** `get_tree` — Get a git tree by SHA. Set recursive=true to get the full tree (all nested directories). Returns tree entries with path, mode, type, sha.
- **POST** `create_tree` — Create a git tree. Each tree entry has path, mode (100644=file, 100755=executable, 040000=directory, 160000=submodule, 120000=symlink), type (blob/tree/commit), and sha or content.
- **POST** `create_blob` — Create a git blob. Content can be utf-8 or base64 encoded (set encoding accordingly).
- **POST** `create_git_commit` — Create a git commit object. tree is the SHA of the tree, parents is an array of parent commit SHAs. Use with create_tree and update_ref for programmatic commits.
- **POST** `create_tag_object` — Create an annotated tag object. object is the SHA to tag. type is the object type (commit, tree, blob). Use create_ref to create the tag ref afterwards.
- **GET** `get_content` — Get file or directory contents. Files are base64 encoded. Directories return a listing. Use ref for a specific branch/tag/SHA.
- **PUT** `create_or_update_file` — Create or update a file. Content must be base64 encoded. To update an existing file, provide the current blob sha (from get_content). Creates a commit.
- **DELETE** `delete_file` — Delete a file from the repository. Requires the current blob sha (from get_content). Creates a commit.
- **GET** `search_code` — Search for code across repositories. Query syntax: 'keyword repo:owner/repo language:go path:internal'. Results include file path, repo, and text matches.
- **GET** `search_issues` — Search issues and PRs across repositories. Query syntax: 'bug repo:owner/repo is:open label:bug'. Use is:pr or is:issue to filter.
- **GET** `search_repos` — Search repositories. Query syntax: 'keyword language:go stars:>100 topic:cli'. Sort: stars, forks, help-wanted-issues, updated.
- **GET** `search_users` — Search users. Query syntax: 'username type:user location:germany language:go followers:>100'.
- **GET** `search_commits` — Search commits. Query syntax: 'fix repo:owner/repo author:username committer-date:>2026-01-01'. Sort: author-date, committer-date.
- **GET** `search_topics` — Search topics by name. Returns matching topic names with descriptions and related info.
- **GET** `list_releases` — List releases for a repository, newest first.
- **GET** `get_latest_release` — Get the latest published release (not draft/prerelease).
- **GET** `get_release` — Get a single release by its numeric ID.
- **GET** `get_release_by_tag` — Get a release by tag name (e.g. 'v1.0.0').
- **POST** `create_release` — Create a release. tag_name is required. If the tag does not exist, target_commitish (branch or SHA) is used to create it. Set draft=true for unpublished releases.
- **PATCH** `update_release` — Update a release. Only include fields you want to change.
- **DELETE** `delete_release` — Delete a release. Does not delete the associated git tag.
- **GET** `list_release_assets` — List assets (attached files) for a release.
- **DELETE** `delete_release_asset` — Delete a release asset.
- **GET** `list_workflows` — List all workflows in a repository. Returns workflow ID, name, path, and state.
- **GET** `get_workflow` — Get a specific workflow by ID or filename (e.g. 'ci.yml').
- **POST** `dispatch_workflow` — Trigger a workflow_dispatch event. ref is the branch/tag to run on. inputs is a map of workflow input values.
- **GET** `list_workflow_runs` — List workflow runs for a repository. Filter by branch, status (queued, in_progress, completed), or event (push, pull_request).
- **GET** `get_workflow_run` — Get a single workflow run including status, conclusion, and timing.
- **GET** `list_workflow_run_jobs` — List jobs for a workflow run. Filter by latest attempt or all attempts.
- **GET** `get_job` — Get a single workflow job by ID, including steps with status and timing.
- **GET** `get_job_log` — Download the log output of a workflow job. Returns plain text with timestamps. The API responds with a 302 redirect to a temporary download URL which is followed automatically.
- **POST** `cancel_workflow_run` — Cancel a workflow run that is in progress or queued.
- **POST** `rerun_workflow` — Re-run an entire workflow run. Only works for completed runs.
- **POST** `rerun_failed_jobs` — Re-run only the failed jobs in a workflow run.
- **DELETE** `delete_workflow_run` — Delete a workflow run. The run must be completed.
- **GET** `list_workflow_run_artifacts` — List artifacts for a workflow run. Artifacts are files produced during a run (logs, binaries, test results).
- **GET** `list_repo_secrets` — List repository secrets for GitHub Actions. Only returns secret names, not values.
- **GET** `get_repo_public_key` — Get the public key for encrypting secrets. Required before creating or updating a secret.
- **PUT** `create_or_update_repo_secret` — Create or update a repository secret. The encrypted_value must be encrypted with the repo's public key (from get_repo_public_key) using libsodium.
- **DELETE** `delete_repo_secret` — Delete a repository secret.
- **GET** `list_repo_variables` — List repository variables for GitHub Actions.
- **POST** `create_repo_variable` — Create a repository variable for GitHub Actions.
- **PATCH** `update_repo_variable` — Update a repository variable.
- **DELETE** `delete_repo_variable` — Delete a repository variable.
- **GET** `list_repo_webhooks` — List webhooks for a repository.
- **GET** `get_repo_webhook` — Get a single webhook by ID.
- **POST** `create_repo_webhook` — Create a webhook for a repository. config.url is the payload URL. events is an array of event names (e.g. ['push', 'pull_request']).
- **PATCH** `update_repo_webhook` — Update a webhook. Only include fields you want to change.
- **DELETE** `delete_repo_webhook` — Delete a webhook from a repository.
- **POST** `ping_repo_webhook` — Send a ping event to a webhook to test its configuration.
- **GET** `list_deployments` — List deployments for a repository. Filter by sha, ref, task, or environment.
- **GET** `get_deployment` — Get a single deployment.
- **POST** `create_deployment` — Create a deployment. ref is the branch/tag/SHA to deploy. environment defaults to 'production'.
- **DELETE** `delete_deployment` — Delete a deployment. Only inactive deployments can be deleted.
- **GET** `list_deployment_statuses` — List statuses for a deployment. States: error, failure, inactive, in_progress, queued, pending, success.
- **POST** `create_deployment_status` — Create a deployment status. state: error, failure, inactive, in_progress, queued, pending, success.
- **GET** `list_environments` — List deployment environments for a repository.
- **GET** `get_environment` — Get a deployment environment by name.
- **PUT** `create_or_update_environment` — Create or update a deployment environment. Configure wait_timer (minutes), reviewers, and deployment_branch_policy.
- **DELETE** `delete_environment` — Delete a deployment environment.
- **GET** `list_labels` — List all labels for a repository.
- **GET** `get_label` — Get a single label by name.
- **POST** `create_label` — Create a label. Color is a 6-character hex code without '#' prefix (e.g. 'ff0000' for red).
- **PATCH** `update_label` — Update a label. Only include fields you want to change. Use new_name to rename.
- **DELETE** `delete_label` — Delete a label from the repository.
- **GET** `list_milestones` — List milestones for a repository. State: open, closed, all.
- **GET** `get_milestone` — Get a single milestone by its number, including open/closed issue counts.
- **POST** `create_milestone` — Create a milestone. due_on is an ISO 8601 timestamp (e.g. '2026-04-01T00:00:00Z').
- **PATCH** `update_milestone` — Update a milestone. Set state to 'closed' to close it. Only include fields you want to change.
- **DELETE** `delete_milestone` — Delete a milestone.
- **GET** `get_authenticated_user` — Get the currently authenticated user's profile including login, name, email, and bio.
- **GET** `get_user` — Get a public user profile by username.
- **GET** `list_followers` — List followers of a user.
- **GET** `list_following` — List users that a user is following.
- **GET** `list_tags` — List tags for a repository, newest first. Each tag includes name and commit SHA.
- **GET** `list_stargazers` — List users who have starred a repository.
- **GET** `list_starred_repos` — List repositories starred by the authenticated user.
- **GET** `check_starred` — Check if the authenticated user has starred a repo. Returns 204 if yes, 404 if no.
- **PUT** `star_repo` — Star a repository for the authenticated user.
- **DELETE** `unstar_repo` — Unstar a repository for the authenticated user.
- **GET** `list_watchers` — List users watching (subscribed to) a repository.
- **GET** `get_repo_subscription` — Get the authenticated user's subscription (watch status) for a repository.
- **PUT** `watch_repo` — Watch a repository. Set subscribed=true to receive notifications, ignored=true to mute.
- **DELETE** `unwatch_repo` — Stop watching a repository.
- **GET** `list_gists` — List gists for the authenticated user.
- **GET** `list_public_gists` — List public gists, newest first.
- **GET** `list_starred_gists` — List gists starred by the authenticated user.
- **GET** `get_gist` — Get a single gist by ID, including all files and their content.
- **POST** `create_gist` — Create a gist. files is a map of filename to {content: string}. Set public=true for a public gist.
- **PATCH** `update_gist` — Update a gist. To delete a file, set its value to null. To rename, delete the old name and create a new one.
- **DELETE** `delete_gist` — Delete a gist.
- **GET** `list_notifications` — List notifications for the authenticated user. Set all=true to include read notifications.
- **PUT** `mark_notifications_read` — Mark all notifications as read. Optionally provide last_read_at (ISO 8601) to only mark notifications before that time.
- **GET** `list_repo_notifications` — List notifications for a repository.
- **PUT** `mark_repo_notifications_read` — Mark all notifications in a repository as read.
- **GET** `get_notification_thread` — Get a single notification thread.
- **PATCH** `mark_thread_read` — Mark a notification thread as read.
- **GET** `list_check_runs_for_ref` — List check runs for a commit SHA, branch name, or tag. Filter by check_name, status, or filter (latest, all).
- **GET** `list_check_run_annotations` — List annotations for a check run. Returns inline lint/test errors with file path, line number, and message. Use this to inspect CI failure details programmatically.
- **GET** `list_check_suites_for_ref` — List check suites for a commit SHA, branch name, or tag.
- **GET** `get_combined_status` — Get the combined status for a commit (aggregates all status checks). Returns state: success, failure, pending.
- **GET** `list_commit_statuses` — List individual status checks for a commit ref.
- **POST** `create_commit_status` — Create a commit status. state: error, failure, pending, success. Provide target_url for linking to CI details.
- **GET** `get_pages` — Get GitHub Pages configuration for a repository.
- **POST** `create_pages_site` — Enable GitHub Pages for a repository. source.branch is the branch to publish from, source.path is '/' or '/docs'.
- **PUT** `update_pages_info` — Update GitHub Pages configuration.
- **DELETE** `delete_pages_site` — Disable GitHub Pages for a repository.
- **GET** `list_pages_builds` — List GitHub Pages builds.
- **GET** `list_code_scanning_alerts` — List code scanning alerts for a repository. State: open, closed, dismissed, fixed.
- **GET** `get_code_scanning_alert` — Get a single code scanning alert.
- **PATCH** `update_code_scanning_alert` — Update a code scanning alert. Set state to 'dismissed' with a dismissed_reason, or 'open' to reopen.
- **GET** `list_dependabot_alerts` — List Dependabot alerts for a repository. State: auto_dismissed, dismissed, fixed, open.
- **GET** `get_dependabot_alert` — Get a single Dependabot alert.
- **PATCH** `update_dependabot_alert` — Update a Dependabot alert. Set state to 'dismissed' with a dismissed_reason, or 'open' to reopen.
- **GET** `list_secret_scanning_alerts` — List secret scanning alerts for a repository. State: open, resolved.
- **GET** `get_secret_scanning_alert` — Get a single secret scanning alert.
- **PATCH** `update_secret_scanning_alert` — Update a secret scanning alert. Set state to 'resolved' with a resolution (false_positive, wont_fix, revoked, used_in_tests, pattern_edited, pattern_deleted).
- **GET** `list_org_packages` — List packages in an organization. package_type is required: npm, maven, rubygems, docker, nuget, container.
- **GET** `get_org_package` — Get a specific package in an organization.
- **DELETE** `delete_org_package` — Delete an entire package in an organization. Requires admin permissions. Cannot be undone after 30 days.
- **POST** `restore_org_package` — Restore a deleted organization package. Only works within 30 days of deletion.
- **GET** `list_org_package_versions` — List all versions of an organization package. Filter by state: active (default), deleted.
- **GET** `get_org_package_version` — Get a specific version of an organization package.
- **DELETE** `delete_org_package_version` — Delete a specific version of an organization package. Cannot be undone after 30 days.
- **POST** `restore_org_package_version` — Restore a deleted version of an organization package. Only works within 30 days.
- **GET** `list_user_packages` — List packages owned by the authenticated user. package_type is required: npm, maven, rubygems, docker, nuget, container.
- **GET** `get_user_package` — Get a package owned by the authenticated user.
- **DELETE** `delete_user_package` — Delete a package owned by the authenticated user. Cannot be undone after 30 days.
- **GET** `list_user_package_versions` — List all versions of a package owned by the authenticated user.
- **DELETE** `delete_user_package_version` — Delete a specific version of a package owned by the authenticated user.

## Which DADLs are related to GitHub?

- [GitLab](https://www.dadl.ai/d/gitlab/) — GitLab REST API v4 — projects, issues, merge requests, pipelines, CI/CD, and code search
- [Zammad](https://www.dadl.ai/d/zammad/) — Zammad helpdesk REST API -- tickets, articles, users, organizations, groups, roles, knowledge base, SLAs, calendars, object manager (custom fields), macros, triggers, overviews, reports, time accounting, and full admin surface. Supports X-On-Behalf-Of impersonation on every endpoint.
- [Zulip](https://www.dadl.ai/d/zulip/) — Zulip REST API — messages, channels (streams), topics, users, user groups, subscriptions, reactions, drafts, scheduled messages, saved snippets, presence, real-time events, invitations, attachments, custom emoji, linkifiers, and server settings. Self-hosted or Zulip Cloud.
- [BookStack](https://www.dadl.ai/d/bookstack/) — BookStack wiki and documentation platform REST API -- shelves, books, chapters, pages (HTML/Markdown content), attachments, image gallery, comments, cross-entity search, exports (HTML/Markdown/PDF/ZIP), ZIP imports, users, roles, content permissions, recycle bin, audit log and tags. Hierarchy: shelves > books > chapters > pages.
- [ELITEDOMAINS](https://www.dadl.ai/d/elitedomains/) — ELITEDOMAINS domain registrar API -- register/transfer/manage .de and gTLD domains, redirector & inline DNS, AuthInfo/AuthInfo2 transfer codes, RGP catcher backorders, contact handles, and marketplace offers (Sedo, sale pages)
- [Graylog](https://www.dadl.ai/d/graylog/) — Graylog REST API -- log search (Views/Search + legacy universal), streams, pipelines, inputs, alerts, events, dashboards, users, roles, sidecars, index management, and cluster administration. Targets Graylog 6.x.

---

**Canonical URL:** https://www.dadl.ai/d/github/
**Raw DADL:** https://github.com/DunkelCloud/dadl-registry/blob/main/github.dadl