Set up GitHub MCP

GitHub MCP lets Glean Assistant and agents retrieve live information and perform actions directly in GitHub, such as creating issues, updating files, and opening pull requests. The GitHub connector indexes content for search in Glean, while MCP tools interact with GitHub when users run them.

To set up GitHub MCP, configure authentication with Glean's central GitHub App or a custom app that your organization manages. Users connect their own GitHub accounts, and GitHub limits tool access to the resources and permissions available to both the user and the app.

Choose the GitHub App

Glean provides separate central GitHub Apps for indexing and MCP tools:

Purpose	GitHub App
Index content with the GitHub connector	glean-github-app
Use GitHub MCP tools	glean-github-app-oauth

Install your selected MCP app (either Glean's central app or your custom app) in each GitHub organization you want to connect, then grant it access to the required repositories.

note

Complete this setup even if you already use the Glean GitHub connector for search indexing. Glean provides separate central apps for indexing and MCP tools, so installing the indexing app does not install the MCP app.

After a GitHub organization administrator installs the app, each user must authorize it with their own GitHub account so it can act on their behalf.

Prerequisites

Before you begin:

• Have permission to add and manage MCP tools in the Glean Admin console.
• Arrange approval to install a GitHub App in each relevant organization and grant access to the target repositories.
• Use a GitHub account that can access the repositories you plan to test.
• For custom authentication, have permission to create and manage a GitHub App.

Open GitHub MCP setup

If you already have a GitHub MCP configuration, use it to follow this guide rather than creating a new one. Open the existing configuration from the GitHub connector's Tools tab or under Platform → Tools, depending on where you manage it.

To add a new configuration:

1. In the Admin console, go to Platform → Tools and click Add.
2. In Add tools, select Vendor provided tools (via MCP).
3. Select GitHub MCP.

After you select GitHub MCP, follow the instructions for the screen that opens:

• GitHub connector setup: In the Workspace step, enter a Name for the connector and select GitHub Cloud under Hosting. Click Continue to proceed to Connect, where you configure authentication.
• Standalone MCP editor: Glean fills in the GitHub server URL and transport settings automatically. Follow the authentication instructions for the options available in your editor.

note

Selecting GitHub Server opens the self-hosted connector's indexing setup, which does not include the MCP Connect step. The connector setup instructions in this guide apply to the GitHub Cloud path.

For an existing connector with a Connect step, click Edit setup or Continue setup to return to that step. For help finding an existing configuration, see Set up tools and MCP integrations from Connectors.

If you don't see either setup screen, contact Glean Support for guidance on configuring GitHub MCP for your deployment.

Configure authentication

Choose the central app or a custom app that your organization manages.

Central app

If your setup offers Central, you can use Glean's managed GitHub App without creating an app or supplying client credentials. If your configuration requires a custom app, follow the Custom app instructions instead.

1. In the connector's Connect step, select Central. In the standalone editor, select Central under OAuth type when that control appears.
2. Open the app's installation page: glean-github-app-oauth.
3. Review the app's permission requests with your GitHub administrator.
4. Install the app in a relevant GitHub organization and grant access to the repositories users need.
5. Repeat the installation for each relevant organization. If an organization already has the app, check that its installation includes the target repositories.
6. Return to Glean and complete Connect and review tools.

Custom app

Choose custom authentication when your organization needs to manage its own GitHub App, and create a GitHub App rather than a classic OAuth App.

In the connector's Connect step, click Set up a custom app instead to select Custom. Glean shows Custom app setup, Client ID, Client secret, and Callback URL.

In the standalone editor, use the Client ID, Client secret, and Callback URL fields for custom authentication. If the editor shows OAuth type, select Custom first.

Create the app

Open the settings for the GitHub account or organization that will own the app:

1. Go to Developer settings → GitHub Apps.
2. Click New GitHub App.
3. Configure the app using the following fields.

Field	Configuration
GitHub App name	Choose a globally unique name.
Homepage URL	Enter https://app.glean.com.
Callback URL	Copy the callback URL from this GitHub MCP configuration in Glean.
Enable Device Flow	Leave unchecked.
Webhook → Active	Leave unchecked.

Copy the displayed callback URL rather than constructing one from your Glean sign-in URL. The MCP callback ends in /tools/oauth/verify_code.

Configure permissions and installation scope

In your GitHub App settings, configure the following permissions under Permissions. This list comes from Glean's Custom app setup instructions and applies to both connector setup and the standalone editor.

Category	Permission	Access
Repository	Actions	Read & write
Repository	Checks	Read-only
Repository	Commit statuses	Read & write
Repository	Contents	Read & write
Repository	Metadata	Read-only
Repository	Pull requests	Read & write
Organization	Members	Read-only
Account	Email addresses	Read-only

Some MCP tools require permissions beyond this setup list. Grant additional permissions only for the operations your team plans to use, such as the examples below:

Operation	Additional permission	Access
Create issues	Repository Issues	Read & write
Create or update files in .github/workflows/	Repository Workflows, in addition to Contents	Read & write
Read code scanning alerts	Repository Code scanning alerts	Read-only
Read secret scanning alerts	Repository Secret scanning alerts	Read-only
Create or update Gists	Account Gists	Read & write

For other operations, review GitHub's guidance on choosing app permissions and REST API permission reference. Check the requirements for the specific operation rather than granting every available permission. GitHub recommends testing the queries and mutations your app uses for GraphQL tools, including Discussions and Projects.

GitHub App permissions differ from OAuth scopes such as repo and user:email. Configure the app's permissions rather than treating those scope names as permission settings. GitHub limits each user's access to the permissions and resources that both the user and the app can access. Some operations also require a specific GitHub role or product feature.

Test the operations you intend to enable, because a successful connection or tool discovery does not confirm that the app can run every tool. If you add permissions to an existing app, ask the installation owner to approve the new permissions before you test again.

For Where can this GitHub App be installed?, choose a setting that permits installation in every required organization. The Only on this account option limits installation to the app owner's account and does not support installation in other organizations. For details, see Making a GitHub App public or private.

Click Create GitHub App after you finish the configuration.

Add credentials and install the app

Use the credentials from the GitHub App you created for MCP:

1. Copy the app's Client ID.
2. Under Client secrets, click Generate a new client secret.
3. Enter the client ID and client secret in the GitHub MCP configuration in Glean. Keep the client secret confidential.
4. In the GitHub App settings, click Install App.
5. Install the app in each relevant organization and grant access to the target repositories. Check existing installations as well as new ones.
6. Return to Glean and complete Connect and review tools.

Connect and review tools

Follow the instructions for your setup screen to connect GitHub and review who can use its tools.

Connect from connector setup

note

When you connect a new MCP configuration through connector setup, Glean automatically discovers and enables its tools with default audience settings. Review these settings after connecting to confirm who can use the tools.

1. In the Connect step, click Connect and authorize the GitHub App you configured for MCP.
2. Wait for Glean to finish discovering tools and display Connected.

To review tool audiences, return to the connector's details page rather than continuing through indexing setup:

1. Go to Admin console → Connectors and click the connector's name. Selecting Continue setup reopens the guided setup instead.
2. Open Tools → Advanced settings and review access to read and write tools.
3. Click Save to apply the audience settings.

note

Some deployments let you open the connector's details page while indexing setup remains incomplete. If clicking the connector's name reopens guided setup instead, contact Glean Support for the tools-only setup path available in your deployment.

Glean discovers MCP tools without waiting for an initial crawl, but managing tool audiences does not complete indexing setup. The separate Set up indexing step configures the connector's indexing app. The Skip for now option, when available in Review setup, defers crawling; it does not bypass indexing configuration.

Connect in the standalone editor

Add a new configuration

Connect to GitHub to discover the available tools, then review their audiences before enabling them. Glean does not enable tools during discovery.

1. Click Initiate connection and authorize the GitHub App you configured for MCP.
2. After Glean discovers the tools, open Enable tools → Edit settings.
3. Review the available tools and set their audiences.
4. Click Save to enable the tools for those audiences.

Update an existing configuration

Save changes to authentication settings or client credentials before reconnecting, so Glean uses the updated configuration:

1. After you change the settings, click Save.
2. If Glean asks you to reconnect, open Configuration and click Initiate connection.
3. Authorize the GitHub App if Glean prompts you.
4. Open Enable tools → Edit settings to review the tool audiences, then click Save if you make changes.

For more information about the standalone editor, see Connect remote MCP servers to Glean.

Authorize users and verify access

Users connect their own GitHub accounts when Glean prompts them to authorize the MCP app. Connecting as an administrator authorizes only your account, not everyone in your organization.

Before you roll out the integration, verify repository access and tool audiences with a test account:

1. Choose a repository that both the test user and the MCP app can access.
2. Run a read-only GitHub MCP tool and confirm that it returns the expected data for that repository.
3. Repeat the test for a repository in each GitHub organization you want to connect.
4. Review the tool audiences in Glean to confirm that they match your intended access settings.

If you also test tools that make changes in GitHub, use only a repository where you have approval to make those changes.

Troubleshoot repository access

If Glean indexes a repository successfully but GitHub MCP tools return 404 Not Found, check that the organization has installed the app configured for MCP. Installing the indexing app or authorizing a GitHub account does not replace this organization-level installation.

A 404 Not Found error alone does not identify the cause. For this error or other repository access failures, check the following:

1. Confirm whether the MCP configuration uses the central app or a custom app.
2. Check that the organization that owns the repository has installed that app, not just the connector app.
3. Check that the app installation includes the repository.
4. Confirm that the user authorized the configured MCP app and can access the repository in GitHub.
5. Check the app permissions for the tool you want to run.

If the checks don't resolve the error, contact Glean Support with the tool name and error message. Don't include client secrets or access tokens.