GitHub MCP Server 1.1.2

What's Changed

• Lockdown mode: scope RepoAccessCache per request by @kerobbi in #2571

Full Changelog: v1.1.1...v1.1.2

GitHub MCP Server 1.1.1

Bugfix release for MCP APP Resources.

What's Changed

• deps: bump go-sdk to v1.6.1 and drop CrossOriginProtection workaround by @SamMorrowDrums in #2564
• I want to enable only ifc by @JoannaaKL in #2565
• OSS release prep by @SamMorrowDrums in #2568
• Register MCP App UI resources in shared server constructor by @SamMorrowDrums in #2570

Full Changelog: v1.1.0...v1.1.1

GitHub MCP Server 1.1.0

Highlights ✨

Insiders Mode: Issue Fields Support

Issue field support is now available behind the remote_mcp_issue_fields feature flag, and is enabled automatically in Insiders Mode. This includes listing issue fields, filtering issues by custom field values, and reading or writing issue field values.

Insiders Mode: CSV Output

CSV output for default list_* tools is now available behind the csv_output feature flag, and is enabled automatically in Insiders Mode. CSV provides a flatter, more compact representation for list-style responses, helping to reduce token usage for large result sets.

Context Reduction for GitHub Projects

Project item responses have been significantly reduced in size. list_project_items, get_project_item, and update_project_item now return compact project item, content, and field-value shapes instead of full GitHub issue and pull request payloads, cutting unnecessary context while preserving the information agents need.

Commit Search

A new search_commits tool has been added, allowing agents to search commits directly using GitHub search syntax. This fills a gap between listing repository commits and finding specific commits across debugging, auditing, and release investigation workflows.

GHAS Alert Pagination

The GHAS alert listing tools now support pagination. list_code_scanning_alerts, list_dependabot_alerts, and list_secret_scanning_alerts can now retrieve beyond the first page of results, avoiding incomplete alert summaries for repositories with larger security backlogs.

Reliability and Hardening

This release includes several tool reliability improvements, including returning isError for argument validation failures so agents can self-correct, guarding completions requests against malformed params, and ignoring proxy forwarding headers by default when building OAuth resource metadata.

What's Changed

• build(deps): bump github.com/google/jsonschema-go from 0.4.2 to 0.4.3 by @dependabot[bot] in #2393
• build(deps): bump actions/attest-build-provenance from 3 to 4 by @dependabot[bot] in #2123
• build(deps): bump actions/setup-node from 4 to 6 by @dependabot[bot] in #2015
• build(deps): bump node from 20-alpine to 26-alpine by @dependabot[bot] in #2013
• build(deps): bump hono from 4.12.0 to 4.12.19 in /ui in the npm_and_yarn group across 1 directory by @dependabot[bot] in #2097
• build(deps): bump ui dependencies to clear security advisories by @SamMorrowDrums in #2493
• build(deps): bump distroless/base-debian12 from 9dce90e to 58695f4 by @dependabot[bot] in #2497
• build(deps): bump reproducible-containers/buildkit-cache-dance from 3.3.2 to 3.4.0 by @dependabot[bot] in #2500
• build(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 by @dependabot[bot] in #2499
• build(deps): bump github.com/modelcontextprotocol/go-sdk from 1.5.1-0.20260403154220-27f29c1cef3b to 1.6.0 by @dependabot[bot] in #2498
• chore(ui): migrate vite 6 → 8, plugin-react 4 → 6; cache UI build in CI by @SamMorrowDrums in #2501
• fix: guard CompletionsHandler against nil params/ref by @SamMorrowDrums in #2502
• fix(ui): advertise get_me as an app via _meta.ui.visibility by @SamMorrowDrums in #2503
• fix(pull_request_read): expose 'after' cursor parameter in input schema by @jluocsa in #2489
• refactor: simplify NewServerTool naming by @SamMorrowDrums in #2510
• fix: return isError for argument validation failures by @SamMorrowDrums in #2511
• refactor: remove dynamic toolsets and deprecated closure constructor by @SamMorrowDrums in #2512
• Adding rationale for fields and labels in issues_granular by @boazreicher in #2505
• Include custom issue field values in list_issues response by @kelsey-myers in #2466
• fix(search_code): tighten query description for accurate model guidance by @SamMorrowDrums in #2513
• Add field_values to search_issues results by @kelsey-myers in #2474
• feat: add pagination to list GHAS alerts tools by @dvirarad in #2451
• feat: Add search commit tool by @Not-Dhananjay-Mishra in #2284
• Fix return Thread node ID in get_review_comments response by @juidesai in #2515
• Add list_issue_fields tool by @kelsey-myers in #2445
• Add custom field filtering to list_issues by @kelsey-myers in #2480
• Remove trailing periods from tool title annotations by @timrogers in #2518
• feat: Add CSV output format for default list tools under insiders mode by @RossTarrant in #2450
• feat(issues): gate issue-fields features behind remote_mcp_issue_fields flag by @SamMorrowDrums in #2520
• chore(gitignore): anchor binary names to repo root by @SamMorrowDrums in #2522
• ci(mcp-diff): build UI artifacts available to baseline checkout by @SamMorrowDrums in #2523
• docs: auto-generate per-flag tool lists for insiders and feature flags by @SamMorrowDrums in #2521
• Adding suggest bool flag to suggest type changes to an issue by @boazreicher in #2548
• Ignore proxy forwarding headers by default for OAuth resource metadata by @SamMorrowDrums in #2550
• docs: update CLI command for adding GitHub PAT in README by @RossTarrant in #2527
• Add support for issue fields values to issues.read and issues.write by @kelsey-myers in #2551
• Boazreicher/add suggest to labels and issue fields by @boazreicher in #2557
• docs: clarify auth in Codex CLI instructions by @RossTarrant in #2549
• feat: gate issue_write and get_issue behind remote_mcp_issue_fields flag by @SamMorrowDrums in #2558
• Reduce project item response size by @RossTarrant in #2563
• build(deps): bump node from e71ac5e to 7c6af15 by @dependabot[bot] in #2540
• build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #2543
• build(deps): bump docker/metadata-action from 6.0.0 to 6.1.0 by @dependabot[bot] in #2544
• build(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #2545
• build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #2546
• build(deps): bump docker/build-push-action from 7.1.0 to 7.2.0 by @dependabot[bot] in #2547
• build(deps): bump github.com/go-chi/chi/v5 from 5.2.5 to 5.3.0 by @dependabot[bot] in #2542

New Contributors

• @jluocsa made their first contribution in #2489
• @boazreicher made their first contribution in #2505
• @dvirarad made their first contribution in #2451
• @Not-Dhananjay-Mishra made their first contribution in #2284
• @juidesai made their first contribution in #2515
• @timrogers made their first contribution in #2518

Full Changelog: v1.0.5...v1.1.0

GitHub MCP Server 1.0.5

What's Changed

• Add ifc label for list_issues tool by @gokhanarkan in #2453
• Add ifc label for get_file_contents tool by @gokhanarkan in #2454
• Add missing pagination on get_reviews by @RossTarrant in #2367
• Add optional rationale parameter to update_issue_type tool by @alondahari in #2458
• Add ifc label for search_issues tool by @gokhanarkan in #2456
• Add ifc label for issue_read tool by @gokhanarkan in #2457
• Add ifc label for search_repositories tool by @gokhanarkan in #2459
• Return minimal code search results with text match snippets by @SamMorrowDrums in #2476
• Replace ingress IFC reader list with private marker by @gokhanarkan in #2478
• Document Copilot Spaces PAT requirements by @Bestra in #2479
• Add tool to list repo collaborators by @JoannaaKL in #2477
• Add tool for discussion comment write operations by @RossTarrant in #2427
• Upgrade go-github to v 0.87 by @iulia-b in #2452

New Contributors

• @alondahari made their first contribution in #2458
• @Bestra made their first contribution in #2479

Full Changelog: v1.0.4...v1.0.5

GitHub MCP Server 1.0.4

What's Changed

• Improve dependabot error message by @aashah in #2375
• Add Xcode installation guide for Codex and Claude Agent by @RossTarrant in #2431
• fix(mcp-apps): defer _meta.ui strip to per-request RegisterTools by @mattdholloway in #2446
• Add ifc label for get_me tool by @JoannaaKL in #2432
• Prevent inputs param from being stripped from actions_run_trigger tool schema by @kerobbi in #2417
• Handle lightweight tags in get_tag by @kerobbi in #2400

New Contributors

• @aashah made their first contribution in #2375

Full Changelog: v1.0.3...v1.0.4

GitHub MCP Server 1.0.3

What's Changed

• Fix lockdown mode permission check by @kerobbi in #2361

Full Changelog: v1.0.2...v1.0.3

GitHub MCP Server 1.0.2

What's Changed

• Fix set_issue_fields mutation: use correct inline fragments for IssueFieldValue union by @iulia-b in #2366

New Contributors

• @iulia-b made their first contribution in #2366

Full Changelog: v1.0.1...v1.0.2

GitHub MCP Server 1.0.1

What's Changed

• Fix Content-Type rejection for application/json; charset=utf-8 by @IrynaKulakova in #2362
• SDK Regression: Re-allow browser-based MCP clients via CORS by @RossTarrant in #2359
• build(deps): bump docker/build-push-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #2357
• build(deps): bump actions/github-script from 8 to 9 by @dependabot[bot] in #2356
• build(deps): bump golang from 04d017a to 5caaf1c by @dependabot[bot] in #2355

New Contributors

• @RossTarrant made their first contribution in #2359

Full Changelog: v1.0.0...v1.0.1

GitHub MCP Server 1.0.0

Highlights

We've made it to release 1.0.0! 🥳

Granular Issue Field Values

New set_issue_fields tool in the granular Issues toolset. Set, update, or delete organization-level custom field values on issues. This is feature flagged under issues_granular

MCP Apps Feature Flag

MCP Apps UI support has been migrated from insiders-only mode to a proper feature flag (remote_mcp_ui_apps). This will be rolled out to more users with supported clients over time.

What's Changed

• build(deps): bump distroless/base-debian12 from 937c7ea to 9dce90e by @dependabot[bot] in #2321
• feat(http): implement HeaderAllowedFeatureFlags for X-MCP-Features header validation by @mattdholloway in #2332
• deps: upgrade modelcontextprotocol/go-sdk to v1.5.0 by @SamMorrowDrums in #2336
• build(deps): bump docker/login-action from 3.7.0 to 4.0.0 by @dependabot[bot] in #2254
• docs: fix broken link to tool renaming guide in README by @marcelsafin in #2316
• build(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by @dependabot[bot] in #2253
• build(deps): bump github.com/josephburnett/jd/v2 from 2.4.0 to 2.5.0 by @dependabot[bot] in #2071
• build(deps): bump golang from 1.25.8-alpine to 1.25.9-alpine by @dependabot[bot] in #2320
• Migrate MCP Apps support from insiders mode to feature flag with insiders opt-in by @SamMorrowDrums in #2335
• Add granular tool to set issue field values by @mattdholloway in #2338

New Contributors

• @marcelsafin made their first contribution in #2316

Full Changelog: v0.33.1...v1.0.0

GitHub MCP Server 0.33.1

Full Changelog: v0.32.0...v0.33.1