Connect a GitHub Remote MCP Server

GitHub hosts a remote server at api.githubcopilot.com/mcp/, exposing repositories, issues, pull requests, Actions, code security alerts, , and more through roughly 80 . This guide covers the Arcade-side setup for connecting it as a remote MCP server, plus the GitHub settings that most commonly trip people up.

This guide is about connecting to GitHub’s own remote server, not the Arcade GitHub toolkits. Arcade already covers most of this surface with two toolkits: the Optimized GitHub toolkit, and the githubapi starter toolkit (818 , including Actions logs, Dependabot alerts, and code scanning alerts). The one confirmed gap is Copilot Spaces, which neither toolkit covers.

Reach for this remote server instead when you want:

One connection instead of combining two toolkits
Access governed by GitHub’s own PAT and OAuth App policies, mirroring your organization’s existing controls

This guide is sourced from GitHub’s own MCP server documentation and policies and governance guide . The Arcade-side field mapping hasn’t been walked through end-to-end against a live GitHub organization. Confirm before treating this as authoritative.

GitHub supports two distinct auth paths for a remote client, and which one fits depends on your governance requirements more than technical difficulty.

Outcomes

Connect a GitHub Remote server to Arcade and use its in gateways and SDKs.

You will Learn

Whether to authenticate with a fine-grained PAT or a registered OAuth App / GitHub App, and why
Which GitHub organization and enterprise settings matter for Arcade specifically
Diagnose the most common setup mistakes from their error messages

Prerequisites

An Arcade
A GitHub or organization with access to the repositories you want to expose
For the OAuth path: ability to register an OAuth App or GitHub App (any GitHub or org owner can do this; no approval from GitHub is required)

Set up GitHub

Option A: Fine-grained Personal Access Token (no app registration)

A fine-grained PAT requires no app registration at all. Create one under Settings → Developer settings → Personal access tokens → Fine-grained tokens, scoped to exactly the repositories and permissions Arcade needs. This is GitHub’s recommended token type over classic PATs, since access is explicitly scoped rather than applying to every repository the can reach.

This path doesn’t use Arcade’s OAuth2 configuration at all. It’s a static credential passed as a header (see Configure the remote server in Arcade below).

Two things limit this path:

PATs don’t respect OAuth App or GitHub App installation policies. If your organization governs third-party access through those mechanisms, a PAT bypasses that governance entirely, which is exactly why GitHub itself doesn’t recommend PATs for production automation.
Enterprise Managed (EMU) have PATs turned off by default. If your organization uses EMU, this path may not be available until an enterprise administrator explicitly enables it.

Option B: Register an OAuth App or GitHub App (recommended for governed rollouts)

Unlike AWS’s managed server, GitHub doesn’t gate this behind an approval process. Any or organization owner can register an OAuth App or GitHub App themselves, under Settings → Developer settings. This is the path that gives you per-user authorization and lets your existing GitHub access policies apply to Arcade’s connection the same way they’d apply to any other third-party integration.

A few organization-level settings affect whether this works smoothly:

OAuth App access restrictions. If your organization has this enabled, an organization administrator must explicitly approve Arcade’s specific OAuth App before members can authorize through it, similar in spirit to Atlassian’s domain allowlist. Notably, GitHub exempts Visual Studio Code and Visual Studio from this restriction by default; Arcade won’t be exempt, so this step is required if the restriction is on.
GitHub Enterprise Server (GHES) or ghe.com: these self-hosted or data-residency variants require registering the OAuth App or GitHub App directly against that instance’s own domain, not github.com. The server URL you register in Arcade will point at your enterprise’s own domain instead of api.githubcopilot.com.

Configure the remote server in Arcade

Register the server

Go to the MCP servers dashboard , click Add Server, choose Remote , and enter a server ID and the server URL:

PLAINTEXT


https://api.githubcopilot.com/mcp/

For GitHub Enterprise Server or ghe.com, use your instance’s own domain instead. Check with your GitHub administrator for the exact remote endpoint on your instance.

If using a fine-grained PAT

Under Advanced settings → Custom headers, add:

PLAINTEXT


Authorization: Bearer ${secret:GITHUB_PAT}

storing the PAT itself as a header secret. There’s no OAuth2 configuration to fill in for this path.

If using an OAuth App or GitHub App

Open Advanced settings → OAuth2 authorization and enter:

Client ID / Client Secret: from the OAuth App or GitHub App you registered.
Authorization URL: https://github.com/login/oauth/authorize
Token URL: https://github.com/login/oauth/access_token

GitHub doesn’t offer Dynamic Client Registration for this. As with most of the providers in this section, these fields need to be filled in manually rather than left blank.

Add the redirect URI to your OAuth App

Only needed for the OAuth App / GitHub App path. Copy the redirect URI Arcade generates and add it to your OAuth App’s or GitHub App’s callback URL settings in GitHub.

Authorize and confirm

Save the server to open the authorization prompt. Sign in with a GitHub that has access to the repositories and organizations you intend to expose. Arcade discovers the available surface based on this identity’s access at setup time.

Troubleshooting

Authorization fails, or GitHub shows an error about the app not being approved: your organization has OAuth App access restrictions enabled, and an organization administrator needs to explicitly approve Arcade’s OAuth App before members can use it.
PAT-based connection returns fewer results than expected, or write actions fail silently: the fine-grained PAT’s scopes don’t cover the repositories or permissions the call needs. Fine-grained PATs are not filtered the way classic PAT scopes are, so some tools may appear available even when the token can’t actually use them. A visible tool isn’t a guarantee of access.
A PAT that should work returns an authentication error entirely: your organization may be an Enterprise Managed User (EMU) , where PATs are turned off by default. Confirm with an enterprise administrator whether PAT access has been explicitly enabled, or switch to the OAuth App path instead.
Connection works for github.com repositories but not an internal GitHub Enterprise Server instance: the server URL and the OAuth App/GitHub App registration both need to point at your enterprise instance’s own domain, not api.githubcopilot.com or github.com.
Calls start failing under moderate load, with rate-limit errors: rate limits differ by auth method. A PAT or OAuth App is capped at 5,000 requests/hour, while a GitHub App installation scales with repos and (up to 12,500, or 15,000 on GitHub Enterprise Cloud). A GitHub App may be worth the extra registration step for higher-volume usage.

Next steps

Create an MCP Gateway to expose this server’s .
Connect to MCP clients.