September 22, 2026
MCP Can Connect Without Write Access: GitHub Hides Write Tools
On September 22, SberTech tech lead Stanislav Ivankevich called MCP an amplifier of LLM vulnerabilities. In GitHub MCP Server, the `--read-only` flag does not register write tools, even if they are specified through `--tools`.
Previously, MCP for GitHub gave an agent read, pull, and push access through a single connection. Now access can be assembled from sets via `--toolsets` or `GITHUB_TOOLSETS`; five sets are available by default: `context`, `repos`, `issues`, `pull_requests`, and `users`.
Access is also restricted by repository. In repository settings, Copilot receives a limited token only for the current repository, while broader access requires a PAT or GitHub App. Once MCP is connected, the agent invokes tools on its own without separate confirmation, so GitHub recommends allowing specific read-only tools instead of `*`.
The local GitHub MCP Server requires a Docker environment; OAuth uses the `127.0.0.1:8085` callback, and the token is kept in memory after sign-in. In Copilot cloud agent and code review, only MCP tools work for now: remote MCP with OAuth, resources, and prompts are not supported there.
For cloud agent and code review, GitHub currently supports only MCP tools, without remote MCP with OAuth, resources, and prompts.
Source
