GitHub MCP Server Files

Highlights

• Server to Server auth is now supported for GitHub apps via stdio so enterprise/cloud workloads can be supported
• Projects tools improved pagination
• The latest changes for the MCP 2026-07-28 spec are included via go-sdk to 1.7.0-pre.3
• Lockdown mode improvements

What's Changed

• build(deps): bump go-sdk to 1.7.0-pre.2 and migrate OAuth to multi-round-trip elicitation by @SamMorrowDrums in https://github.com/github/github-mcp-server/pull/2870
• build(deps): bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1 by @dependabot[bot] in https://github.com/github/github-mcp-server/pull/2824
• build(deps): bump docker/metadata-action from 6.1.0 to 6.2.0 by @dependabot[bot] in https://github.com/github/github-mcp-server/pull/2825
• build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/github/github-mcp-server/pull/2826
• build(deps): bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in https://github.com/github/github-mcp-server/pull/2827
• build(deps): bump golang from 1.25.11-alpine to 1.25.12-alpine by @dependabot[bot] in https://github.com/github/github-mcp-server/pull/2867
• build(deps): bump distroless/base-debian12 from e7e678c to 9c05cfd by @dependabot[bot] in https://github.com/github/github-mcp-server/pull/2868
• Centralise lockdown author checks by @kerobbi in https://github.com/github/github-mcp-server/pull/2881
• build(deps): bump actions/cache from 5 to 6 by @dependabot[bot] in https://github.com/github/github-mcp-server/pull/2794
• build(deps): bump node from a2dc166 to e88a35b by @dependabot[bot] in https://github.com/github/github-mcp-server/pull/2792
• perf(octicons): embed precomputed data URIs by @SamMorrowDrums in https://github.com/github/github-mcp-server/pull/2895
• fix(labels): add DestructiveHint to label_write tool by @syf2211 in https://github.com/github/github-mcp-server/pull/2763
• build(deps): bump go-sdk to 1.7.0-pre.3 by @SamMorrowDrums in https://github.com/github/github-mcp-server/pull/2907
• build(deps): bump distroless/base-debian12 from 9c05cfd to 348dac1 by @dependabot[bot] in https://github.com/github/github-mcp-server/pull/2915
• Paginate project item lookup across memberships by @zwick in https://github.com/github/github-mcp-server/pull/2914
• Add opt-in intent-aware Copilot issue assignment tool by @boazreicher in https://github.com/github/github-mcp-server/pull/2909
• Add node IDs to project resolver results by @zwick in https://github.com/github/github-mcp-server/pull/2922
• Extract aliased project mutation primitive by @zwick in https://github.com/github/github-mcp-server/pull/2923
• build: use patched Go toolchain and UI dependency by @loganrosen in https://github.com/github/github-mcp-server/pull/2927
• feat(auth): add GitHub App server-to-server authentication for stdio by @SamMorrowDrums in https://github.com/github/github-mcp-server/pull/2797
• build(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in https://github.com/github/github-mcp-server/pull/2916
• build(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in https://github.com/github/github-mcp-server/pull/2917
• build(deps): bump golang.org/x/oauth2 from 0.35.0 to 0.36.0 by @dependabot[bot] in https://github.com/github/github-mcp-server/pull/2793
• Add MCP App form deferral opt-out by @connor4312 in https://github.com/github/github-mcp-server/pull/2921
• build(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/github/github-mcp-server/pull/2932

New Contributors

• @loganrosen made their first contribution in https://github.com/github/github-mcp-server/pull/2927

Full Changelog: https://github.com/github/github-mcp-server/compare/v1.6.0...v1.7.0