Authenticate with gh cli or re-use already authenticated

[Moulick]

Describe the feature or problem you’d like to solve

I would be great if the authentication done for gh cli can be reused. Currently, every application that supports MCP has its own configuration file, and hence the GitHub PAT is written to multiple files in plain text.

Proposed solution

Reuse the authentication done for GitHub CLI

Why?

Secure access to GitHub. Prevent GitHub PAT from being stored as plain text in multiple MCP server config files.

[jarodtaylor]

Yes please!

Not to mention PAT have a finite time (unless you don't have an expiration on it—which is discouraged).

[erel213]

I’m not sure if this is feasible within the scope of the GitHub MCP itself, but ideally, this should be integrated with the MCP client that you’re using.

The main reason is that the current GitHub MCP runs in a local Docker container, and the GitHub CLI (gh) supports two authentication methods (see: https://cli.github.com/manual/gh_auth_login):

The default authentication mode is a web-based browser flow. After completion, an authentication token will be stored securely in the system credential store. If a credential store is not found or there is an issue using it gh will fallback to writing the token to a plain text file.

This method isn’t viable because the Docker container doesn’t support browser-based interactions.

Alternatively, use --with-token to pass in a personal access token (classic) on standard input. The minimum required scopes for the token are: repo, read:org, and gist. Take care when passing a fine-grained personal access token to --with-token as the inherent scoping to certain resources may cause confusing behaviour when interacting with other resources. Favour setting GH_TOKEN for fine-grained personal access token usage.

This method doesn’t resolve the issue, as it still requires passing the PAT to the Docker container via environment variables.

Given these limitations, what I have in mind is more aligned with how VS Code handles secure input registration (e.g., Copilot chat with MCP servers), though I understand this is out of scope for this repository.

[ataylorme]

You can run gh auth token yourself and pass it as the personal access token input for VSCode. It is an OAuth user access token that expires every 8 hours.