What is mcp-go-github AGENTS.md?

A project guide for coding agents working on a Go-based GitHub MCP server. It records the commands, code layout, release details, and safety rules that are easy to miss.

Use it when changing tools, running tests or builds, preparing releases, or reviewing pull requests in this repository.

It prevents agents from following outdated documentation, using stale dependencies, skipping required checks, or exposing secrets and hardcoded paths.

mcp-go-github AGENTS.md — Instructions file by scopweb

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add instructions/scopweb/mcp-go-github/agents-md

Clone the repo

git clone --depth 1 https://github.com/scopweb/mcp-go-github

Made for: Codex, OpenCode.

Per session 1,286 This file is loaded in full into every session.

When invoked 1,286 The same file — it is already loaded in full.

Security scan B 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.01286	$0.01286
Opus 5	$0.00643	$0.00643
Sonnet 5	$0.00257	$0.00257
Haiku 4.5	$0.00129	$0.00129

Measured yesterday against content hash 7f8cbd3bf939, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

mcp-go-github AGENTS.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads MCP configurationmediumAgent snooping

mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.

`.env` is gitignored. `.mcp.json` is **not** — never put `GITHUB_TOKEN` there. `safety.json`, `.mcp-backups/`, and `mcp-admin-audit.log*` are gitignored.

AGENTS.md · 96 lines

How it starts

The opening of the file, as written. The whole thing — 96 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

Trust executable sources over README/CLAUDE.md when they disagree. go.mod is Go 1.26.6 and github.com/google/go-github/v88. VERSION is 4.1.0.

Broader product docs: CLAUDE.md, CONTRIBUTING.md, CHANGELOG.md. This file is only what an agent would otherwise get wrong.

Commands

go test ./...                  # what CI runs
go test ./pkg/git/ -v          # one package
go test -race ./...            # script/test (stricter than CI)
go build ./...                 # what CI builds
golangci-lint run              # what CI lints (.golangci.yml)
.\compile.bat                  # Windows binary + VERSION ldflags → github-mcp-server-v4.exe

Unflagged go build reports server version "dev". Release builds inject internal/server.Version from VERSION.
script/lint and script/test are bash. On Windows PowerShell use the commands above, not those scripts.
CI (.github/workflows/ci.yml): go build ./... → go test ./... -v -timeout 60s → golangci-lint latest.
PRs: Conventional Commits, update CHANGELOG.md, no hardcoded paths/tokens.

Do not build with -mod=vendor. vendor/ is stale (go-github/v81); go.mod is v88.

Layout

Custom MCP over stdio JSON-RPC (not mark3labs/mcp-go).

Path	Role
`cmd/github-mcp-server/main.go`	Flags, clients, stdin loop
`internal/server/`	Protocol + tool dispatch. No tests here.
`internal/hybrid/`	Git-first file writes, API fallback
`pkg/git/`	Local git via `exec.Command("git", args...)` (no shell)
`pkg/github/`, `pkg/admin/`, `pkg/dashboard/`	GitHub API wrappers
`pkg/safety/`	Risk map, tokens, validators, audit
`pkg/config/`	Loads `safety.json`
`pkg/interfaces/`	Update this first when adding client methods

ejemplos_github_repositorios/ and test/security/README.md are leftovers from other projects. Ignore them.

Adding or changing tools

Do not add a new top-level tool if an existing one can take another operation. That 26-tool cap is intentional.

Read the full file on GitHub · 96 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 96 lines · 1,286 tokens per session scan B 7f8cbd3bf939

Subscribe to this mod's changes

mcp-go-github AGENTS.md is an instructions file published in the GitHub repository scopweb/mcp-go-github (0 stars, last pushed 15d ago), licensed MIT. It adds 1,286 tokens to every session, about $0.0064 per session on Opus 5. A static security scan graded it B with 1 finding (reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Git and workflow Testing Writing and docs claude-desktop github-mcp-server go

mcp-go-github AGENTS.md

Getting it into your agent

What it costs to keep this loaded

Grade B, and why

Reads MCP configurationmediumAgent snooping

How it starts

AGENTS.md

Commands

Layout

Adding or changing tools

What this file has done since we first saw it

Other instructions, from other repositories

rag-code-mcp copilot-instructions.md

ollama CLAUDE.md

azure-sdk-for-go go-code.instructions.md

gorest AGENTS.md

chatgpt-cli CLAUDE.md

llm-context.py CLAUDE.md