GitHub MCP

How to restrict the GitHub MCP server to one repository

A fine-grained token limits what GitHub accepts. A Meandr policy limits which repository the agent may ask for, and records every call that tries another.

Try for free Quick tour video

Setup

Two layers: a GitHub token and a Meandr policy

A GitHub token gives every agent the same repositories. Meandr policies can name a single agent, so each one reaches only the repository it needs.

  1. 01 Connect

    Add GitHub's MCP server with a token for acme/webapp only

    Create a fine-grained GitHub token for acme/webapp only, then add GitHub's server by URL in Servers with that token as a Bearer token, and Meandr becomes the MCP gateway for GitHub for every agent.

    • Token permissions: Contents, Issues and Pull requests, read and write
    • The token is sealed on save and never shown again, and agents hold only their own Meandr key
    GitHub: fine-grained personal access tokens How Meandr keeps upstream credentials

  2. 02 Tools

    Switch off the GitHub tools the agent doesn't need

    After saving, the Server catalog lists GitHub's tools with the hints GitHub declares, and you switch each one on or off.

    • Delete file is the only default tool GitHub marks destructive
    • Tools you switch off never reach the agent
    How the Server catalog works

  3. 03 Policies

    Allow acme/webapp and deny every other repository

    Add two policies with the GitHub server in Targets, and the first one that matches decides each call.

    • webapp only: Allow, with an Arguments matcher where owner is acme and repo is webapp
    • other repos: Deny below it, with a reason code, and a Default policy of Deny as a backstop
    • Optional: an Approve policy on file and issue changes in acme/webapp, dragged to #1 in Sort policies, so writes wait for a person
    How request conditions match arguments How approval works

  4. 04 Verify

    Ask the agent for a file in acme/billing

    Meandr denies the read before it reaches GitHub, and the agent gets an error instead of a result.

    • Traffic shows the denied call, the other repos policy and your reason code
    • Calls to acme/webapp keep running
    What each call's record holds

Questions about an MCP gateway for GitHub

Isn't the fine-grained token enough?
Use both: a token can't go below a whole repository, while a policy can also match the branch or path of one agent's calls.
Can two agents work in different repositories through one token?
Yes: give each agent its own Allow policy with its own owner and repo, and a token that covers both.
What about GitHub tools that take no owner or repo?
The other repos policy denies them too; to let one through, name that tool in an Allow policy placed above other repos.
What does the agent get on a denied call?
An error instead of a result, while you see the call and its reason code in Traffic.

Keep your GitHub agent in one repository

One fine-grained token, an Allow policy for the repository and a Deny policy for the rest.

Try for free

Questions? Email us