Add it to Claude Code
claude mcp add -e "GH_CLIENT_ID=${GH_CLIENT_ID}" -e "GH_INSTALLATION_ID=${GH_INSTALLATION_ID}" -e "GH_PRIVATE_KEY_PATH=${GH_PRIVATE_KEY_PATH}" github-mcp-shim -- github-mcp-shimGH_CLIENT_IDGH_INSTALLATION_IDGH_PRIVATE_KEY_PATH+ 1 optionalMake your agent remember this setup
github-mcp-shim's config, env vars, and the gotchas you hit — recalled in every future Claude Code, Cursor, and Codex session.
npx conare@latestFree · one command · indexes the sessions already on disk. Set up in the browser instead →
What it does
- Automatically exchanges App Private Key for fresh Installation Access Tokens every 50 minutes
- Acts as a local stdio server for AI clients while communicating with remote MCP endpoints
- Enables fine-grained permissions and short-lived tokens for organizational security
- Environment-driven configuration with no hardcoded secrets
Environment Variables
GH_CLIENT_IDrequiredThe Client ID of your GitHub AppGH_INSTALLATION_IDrequiredThe numeric installation ID of your GitHub AppGH_PRIVATE_KEY_PATHrequiredAbsolute path to your GitHub App's private key .pem fileGH_REMOTE_MCP_URLThe remote MCP endpoint URLTry it
Original README from incognita-labs/github-mcp-shim
GitHub MCP App Shim
A lightweight stdio-to-http relay that enables the GitHub MCP Server to authenticate using a GitHub App instead of a Personal Access Token (PAT).
Why use this?
The official GitHub MCP server typically requires a static PAT. This shim allows your AI agent to use a GitHub App's fine-grained permissions and short-lived tokens, which is more secure for organizational use and avoids the 1-year expiration limit of standard tokens.
Features
- Auto-Refresh: Automatically exchanges your App's Private Key for a fresh Installation Access Token every 50 minutes.
- Stdio Bridge: Acts as a local
stdioserver for AI clients (like Claude Desktop) while communicating with GitHub's remote MCP endpoint overhttps. - Environment Driven: No secrets are hardcoded; all identifiers are passed via environment variables.
Prerequisites
- Python 3.9+
- A GitHub App registered in your organization with the necessary permissions (e.g.,
Contents: Read/Write,Metadata: Read-only). - The App must be installed on the target organization or repositories.
Installation
- Clone or copy the
github_shim.pyandpyproject.tomlinto a folder. - Install the dependencies:
pip install .
Finding Your Credentials
| Identifier | Where to find it |
|---|---|
| Client ID | Found on the General settings page of your GitHub App (e.g., Iv23liABC123). |
| Private Key | Generate and download the .pem file from the General settings page. |
| Installation ID | Navigate to your Org Settings > Installed GitHub Apps > Click Configure next to your app. The ID is the numeric string at the end of the URL (e.g., .../installations/12345678). |
Configuration
Claude Desktop
Add the following to your claude_desktop_config.json (found at ~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"github-app-agent": {
"command": "github-mcp-shim",
"env": {
"GH_CLIENT_ID": "YOUR_CLIENT_ID",
"GH_INSTALLATION_ID": "YOUR_INSTALL_ID",
"GH_PRIVATE_KEY_PATH": "/absolute/path/to/your-app.private-key.pem",
"GH_REMOTE_MCP_URL": "https://api.githubcopilot.com/mcp" // optional
}
}
}
}
Security Note
Keep your .pem private key file secure. Anyone with access to this file and your Client ID can impersonate your agent and access the repositories authorized during the app installation.