[Foxbolts]

Related to #7055

Description

Add a Docker Compose setup for running the official GitHub MCP server locally in read-only mode. The service runs independently of any agent and exposes repository, pull request, and issue tools.

Notes

• Includes a manual check that reads a pull request and checks the server's tool annotations.
• The client supplies a GitHub token; the server does not hold the GitHub App private key.
• Production deployment and agent integration are separate work.

Testing

• Pre-commit checks passed.
• Ran the manual check against the official v2.0.3 server binary and the test PR; all 22 exposed tools reported read-only annotations.
• Started the official container with Docker Compose and repeated the manual PR and read-only tool checks successfully.

[suhaibmujahid]

Looking at github-mcp-server, we might be able to replace all of this by deploying the official container as a service in our GCP project. That would do the work for us with almost no code on our side.

[Foxbolts]

sounds good. replaced the wrapper with a docker compose setup that runs the official gh mcp container in read-only mode for local development. I tested it against a test PR and confirmed it can read the PR and expose read-only tools. iiuc, we can connect an agent to it as part of the GitHub integration, and use the GCP service once it’s deployed

[suhaibmujahid]

Why this under docs?

[Foxbolts]

I just wanted to keep it separate from any particular agent, but I've now moved it to services/github-mcp

[suhaibmujahid]

What is the goal if this check?

[Foxbolts]

just a smoke test to verify that the server can read a PR and check for the tools. Forgot to remove the hardcoded test repo before opening the PR 😅 but I could also remove this if you don't think it's valuable

[suhaibmujahid]

We could drop it. We will later have that tested as part of the integration with the agents anyway.

[suhaibmujahid]

We could drop it. We will later have that tested as part of the integration with the agents anyway.

[suhaibmujahid]

We might need to add env here to pass the auth to the mcp directly instead of having the part of the mcp request if that is supported.

[Foxbolts]

I might be misunderstanding this, but from the GitHub App auth docs, it looks like the server’s built-in App auth may only work in stdio mode, and HTTP clients need to provide a token. I also tried setting GITHUB_PERSONAL_ACCESS_TOKEN on the container, but got a 401 without an auth header. Maybe we need another way to supply the token for the GCP service?