GitHub MCP Server 1.7.0

Highlights

• Server to Server auth is now supported for GitHub apps via stdio so enterprise/cloud workloads can be supported
• Projects tools improved pagination
• The latest changes for the MCP 2026-07-28 spec are included via go-sdk to 1.7.0-pre.3
• Lockdown mode improvements

What's Changed

• build(deps): bump go-sdk to 1.7.0-pre.2 and migrate OAuth to multi-round-trip elicitation by @SamMorrowDrums in #2870
• build(deps): bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1 by @dependabot[bot] in #2824
• build(deps): bump docker/metadata-action from 6.1.0 to 6.2.0 by @dependabot[bot] in #2825
• build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #2826
• build(deps): bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #2827
• build(deps): bump golang from 1.25.11-alpine to 1.25.12-alpine by @dependabot[bot] in #2867
• build(deps): bump distroless/base-debian12 from e7e678c to 9c05cfd by @dependabot[bot] in #2868
• Centralise lockdown author checks by @kerobbi in #2881
• build(deps): bump actions/cache from 5 to 6 by @dependabot[bot] in #2794
• build(deps): bump node from a2dc166 to e88a35b by @dependabot[bot] in #2792
• perf(octicons): embed precomputed data URIs by @SamMorrowDrums in #2895
• fix(labels): add DestructiveHint to label_write tool by @syf2211 in #2763
• build(deps): bump go-sdk to 1.7.0-pre.3 by @SamMorrowDrums in #2907
• build(deps): bump distroless/base-debian12 from 9c05cfd to 348dac1 by @dependabot[bot] in #2915
• Paginate project item lookup across memberships by @zwick in #2914
• Add opt-in intent-aware Copilot issue assignment tool by @boazreicher in #2909
• Add node IDs to project resolver results by @zwick in #2922
• Extract aliased project mutation primitive by @zwick in #2923
• build: use patched Go toolchain and UI dependency by @loganrosen in #2927
• feat(auth): add GitHub App server-to-server authentication for stdio by @SamMorrowDrums in #2797
• build(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in #2916
• build(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in #2917
• build(deps): bump golang.org/x/oauth2 from 0.35.0 to 0.36.0 by @dependabot[bot] in #2793
• Add MCP App form deferral opt-out by @connor4312 in #2921
• build(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #2932

New Contributors

• @loganrosen made their first contribution in #2927

Full Changelog: v1.6.0...v1.7.0