ghcli-mcp

ghcli-mcp

Use the ghcli_exec, ghcli_help, and ghcli_whoami tools for any GitHub operation. They shell out to the real gh CLI on the host, so every gh command is available — not a hand-picked subset.

Tools

• ghcli_whoami — show the authenticated GitHub identity. Call this first if it's unclear whether auth is even working, or the user asks "who am I logged in as".
• ghcli_help — show gh <command> --help text. Call this before ghcli_exec whenever unsure of exact flag names or syntax — it's always safe, never gated.
• ghcli_exec — run any gh <command> <subcommand> ... command. Pass the arguments as an array, without the leading "gh", e.g. args: ["pr", "list", "--repo", "owner/repo"].

Always pass -R/--repo explicitly

This connector's process has no working-directory git repo, so it can't infer which repo a command targets the way an interactive gh session would. Every repo-scoped command needs an explicit -R owner/repo or --repo owner/repo. If a user names a repo in conversation, use it; if they don't and the command needs one, ask which repo rather than guessing.

Safety model — read-only by default

Commands that change state on GitHub (create, delete, edit, close, merge, comment, reopen, archive, and gh api calls with --method other than GET) are blocked unless the connector's server has GHCLI_MCP_ALLOW_WRITE=true configured and the tool call passes confirm=true.

• If a write is attempted while the server is in read-only mode, ghcli_exec returns a clear error saying so — relay that to the user rather than retrying with different arguments; the fix is a config change on their end (see the connector's SETUP.md), not a different command.
• If the server does have writes enabled, still confirm with the user in plain language before calling ghcli_exec with confirm=true on anything destructive or hard to undo (closing/merging a PR, deleting something, editing a title/body) — the tool's confirm flag is a mechanical gate, not a substitute for actually checking with the person you're acting on behalf of.
• Local-only side effects — repo clone, pr checkout, release download — are never gated, since they don't touch anything on GitHub. No need to ask before those.