Repository navigation
Restrict MCP access to private repositories #1685
Description
Describe the feature or problem you’d like to solve
Currently, I can not find a documented method, or a method within the issues/discussions to restrict a local MCP deployment to access only specific repositories (In my case, private repos belonging to the org). I also don't see this option when creating the PAT, as even the "Only select repositories" includes "Also includes public repositories (read-only)."
I have seen some suggestions of modifying the prompt to account for this, but that doesn't offer a deterministic way of restricting the search space for repositories.
Proposed solution
Offer some flag to restrict repo's by org name, and even further by repo name if wanted.
This would allow for agent's to have a focused selection of code, without relying on the model to strictly follow the prompt.
Reacted by Timothy Warren and Guadalupe
Activity
[-]Restrict MCP access to Private Repos[/-][+]Restrict MCP access to private repositories[/+]SamMorrowDrums commentedon Dec 31, 2025
You can create a fine grained token for specific repositories, but I believe you are correct that private repositories only is not currently supported.
It's not something we are against supporting but I couldn't confirm at this stage whether it's a feature we will add. Have you looked at lockdown mode? That at least can limit what is returned to only comments and things from contributors to repositories, so it massively reduces the risks of driveby prompt injection attacks.
Also we have EMU feature for this https://docs.github.com/en/enterprise-cloud@latest/admin/concepts/identity-and-access-management/enterprise-managed-users and in this scenario the user token can only access repositories for the enterprise and not public repositories.
This isn't a rejection of the feature request, just trying to point you in directions that might help in the interim, while we consider this.
fffe commentedon Jun 26, 2026
I don't think there's anything that addresses the non-EMU, local use case though.
Non-Enterprise users can't create fine-grained tokens, and it would be nice to be able to sandbox agents to specific repositories.
Add --allowed-repos to restrict the local server to specific reposito…