Wire the core MCP servers for a data repo

At a glance

Learning objectives

• Configure the filesystem, git and GitHub MCP servers
• Scope each server to the minimum it needs
• Know what each server can and cannot do

What you need

• A repository to work in
• Node/npx and uvx available
• A fine-grained GitHub token (read-only unless the task must open PRs)

Steps

1. Add the filesystem server: `npx -y @modelcontextprotocol/server-filesystem /path/to/allowed/dir`. (from mcp-filesystem )
2. Scope it to a single working directory; never pass a home directory or a mount containing secrets. (from mcp-filesystem )
3. Add the git server: `uvx mcp-server-git --repository /path/to/repo`. (from mcp-git )
4. Note its limits — it can commit and create branches in the scoped repository, but cannot push unless credentials are also present in the environment. (from mcp-git )
5. Add the GitHub server with a token: `docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server`. (from mcp-github )
6. Use a fine-grained token limited to the target repositories and read-only unless the task must open PRs; never grant org-wide admin. (from mcp-github )

Check yourself

• The agent reads files in the allowed directory and commits on the scoped repository, but has no push path and no access outside the directory.
• The GitHub token is fine-grained, repository-scoped and read-only; its permission list shows no org-wide scopes.

Worked example

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/data"]
    }
  }
}

{
  "mcpServers": {
    "git": {
      "command": "uvx",
      "args": ["mcp-server-git", "--repository", "/repo"]
    }
  }
}

{
  "mcpServers": {
    "github": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN", "ghcr.io/github/github-mcp-server"],
      "env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}" }
    }
  }
}

Sourced from

• Filesystem MCP Server
• Git MCP Server
• GitHub MCP Server

Security scan

Last sweep 2026-10-24: 0 finding(s), 0 marked as examples.

Common gotchas

• Never pass a home directory or a mount containing secrets to the filesystem server.
• The git server cannot push unless credentials are also present in the environment.
• Never grant org-wide admin on the GitHub token — scope it to the target repositories.

Production considerations

• Keep the filesystem allowlist to the working directory the task needs.
• Prefer fine-grained, read-only GitHub tokens; widen only when the task must open PRs.

Diagram

agent config
   |
   |- mcp-filesystem --> one allowed dir --> read/write in scope only
   |
   |- mcp-git --> one repository --> status/diff/log/commit, no push
   |
   |- mcp-github --> fine-grained token --> read-only unless PRs required

Registry stats