// teleport guide · DevOps · official

Teleport GitHub MCP — read-only, P2P, zero cloud

The official GitHub MCP server mixes read tools with destructive ones that act on YOUR token: push_files, fork_repository, merge_pull_request. MCPWire's firewall lets a peer's agent search repos and read issues while every write path stays invisible. This guide maps all 12 tools of @modelcontextprotocol/server-github by blast radius, then gives you the exact command to share it with a remote teammate's AI agent — capability without credentials.

5SAFE to expose

0CAUTION

7KEEP LOCAL

0servers involved

host terminal — read-only share command

npx -y mcpwire share --allow "search_repositories,get_file_contents,get_pull_request,list_issues,list_commits" --redact-secrets --ttl 30m -- npx -y @modelcontextprotocol/server-github

Only the 5 read-only tools are exposed; the other 7 are invisible to the peer (filtered from tools/list and blocked if forced). Tunnel dies in 30 minutes. Add --confirm to approve every call, or --max-calls 20 for a hard budget.

peer config — claude_desktop_config.json / .cursor/mcp.json

{
  "mcpServers": {
    "teleported-github": {
      "command": "npx",
      "args": [
        "-y",
        "mcpwire",
        "join",
        "wire://<TICKET_FROM_HOST_BANNER>"
      ]
    }
  }
}

🛡️ tool risk map — GitHub

tool	risk	notes
`search_repositories`	SAFE	Repo search.
`get_file_contents`	SAFE	Reads files/dirs from a repo.
`get_pull_request`	SAFE	PR details.
`list_issues`	SAFE	Issue listing.
`list_commits`	SAFE	Commit history.
`create_issue`	HIGH RISK	Writes to your repos.
`add_comment_to_issue`	HIGH RISK	Posts as your identity.
`create_pull_request`	HIGH RISK	Opens PRs.
`merge_pull_request`	HIGH RISK	Merges code.
`fork_repository`	HIGH RISK	Forks under your account.
`push_files`	HIGH RISK	Commits directly to branches.
`create_branch`	HIGH RISK	Branch mutation.

🔒 Why not just share your token?

GitHub's credential would grant the full toolset to a foreign LLM — including create_issue and add_comment_to_issue. With mcpwire the credential stays in your env; the peer only ever holds an expiring wire:// capability scoped to 5 tools.

🎥 Audit everything

Add --record session.wirelog and every call, block and redaction is logged locally. Drag the file into mcpwire.co/replay for a DevTools-style waterfall of what the remote agent actually did.

🔁 Works with every MCP client

Claude Desktop, Cursor, Windsurf, Cline — anything speaking MCP over stdio. Your peer pastes the snippet above; you keep the kill-switch (Ctrl+C) in your terminal.

What happens if the peer's agent tries to call a blocked GitHub tool?

The request never reaches your MCP server. mcpwire answers with a JSON-RPC error (-32601 [MCPWire Firewall]) and logs the attempt — the tool doesn't exist from the agent's point of view, so well-behaved agents won't even try.

Can I expose the caution-level tools too?

Yes — just add them to --allow or run with --confirm so each call waits for your y/n in the host terminal. The risk map above tells you exactly what you'd be signing up for.

Is the traffic really serverless?

Yes. Discovery goes through the public Hyperswarm DHT; the data path is a direct Noise-encrypted socket between the two machines (UDP hole punching). If both NATs are stubborn, Hyperswarm routes through community relays — which only see ciphertext.

← all teleport guides ⚡ open the policy builder

🔒 MCPWire Enterprise & Team Mesh (Early Access)

Need persistent wire://your-company/db namespaces, SSO / GitHub identity verification before the P2P handshake, and centralized audit logs for compliance (SOC2 / ISO)?