Avoid a bad dependency decision
Will this connector break when we install it?
Official GitHub MCP docs looked good. TruthAPI also found same-day Claude Code OAuth failures, a missing-scope report, and the available read-only controls.
BEFORE
Install from the supported plugin path.
AFTER
Adopt read-only; avoid the broken OAuth path.
Connector adoption checkView session ↓Close ↑
> Should we connect Claude Code to GitHub MCP?
tool: truthapi.getSummaries({
query: "GitHub MCP Claude Code OAuth scopes breakage security user reports",
total: 30
})
TruthAPI
Same-day GitHub issues report that Claude Code's bundled GitHub MCP cannot
complete OAuth. A separate report identifies missing organization scopes.
Official GitHub MCP docs expose read-only URLs, toolset restrictions,
lockdown headers, and least-privilege token guidance.
Claude
Decision: adopt with strong guardrails.
Start read-only, enable only required toolsets, and avoid the currently broken
plugin OAuth path until the issue is resolved.