diff --git a/docs/hackbot/github.md b/docs/hackbot/github.md
new file mode 100644
index 0000000000..8962385dc6
--- /dev/null
+++ b/docs/hackbot/github.md
@@ -0,0 +1,28 @@
+# GitHub MCP server for local development
+
+The official GitHub MCP server provides read-only repository, pull request, and
+issue tools. The Compose setup runs it locally for development, independently of
+any agent. Production deployment and agent integration are separate work.
+
+## Start the server
+
+Install Docker with Compose and start Docker, then run from the repository root:
+
+```bash
+docker compose -f services/github-mcp/compose.yml up -d
+```
+
+The server listens at `http://127.0.0.1:8082/`. Clients running on the same
+Compose network can use `http://github-mcp:8082/`. Each client must supply a
+GitHub token in its `Authorization` header; the server does not hold the App's
+private key.
+
+The container's read-only flag controls its exposed tools. GitHub token
+permissions also restrict what the token can do. The local server is not a
+replacement for production access control.
+
+When finished:
+
+```bash
+docker compose -f services/github-mcp/compose.yml down
+```
diff --git a/pyproject.toml b/pyproject.toml
index 5b1cfa8fd4..37d73a4438 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -148,6 +148,8 @@ members = ["http_service", "agents/*", "libs/*", "services/*", "tools/*"]
 exclude = [
     # JavaScript package (no pyproject.toml).
     "services/hackbot-ui",
+    # Compose configuration, not a Python package.
+    "services/github-mcp",
     # Not migrated to the workspace yet.
     "services/buildrepair",
 ]
diff --git a/services/github-mcp/compose.yml b/services/github-mcp/compose.yml
new file mode 100644
index 0000000000..034c410803
--- /dev/null
+++ b/services/github-mcp/compose.yml
@@ -0,0 +1,6 @@
+services:
+  github-mcp:
+    image: ghcr.io/github/github-mcp-server:v2.0.3
+    command: ["http", "--read-only", "--toolsets=repos,pull_requests,issues"]
+    ports:
+      - "127.0.0.1:8082:8082"