Scaling GitHub for your Agents — Sam Morrow, GitHub

April 27, 202620:353,072 views

Summary

Sam Morrow, who leads development of GitHub's MCP server, presents the architectural decisions, technical challenges, and production lessons learned from building and scaling GitHub's remote MCP server at AI Engineer Europe 2026. The talk covers the full journey from GitHub's public MCP launch in April 2024 to serving nearly 8 million tool calls per week.

GitHub open-sourced its local MCP server in April 2024, quickly becoming the most-starred repository on GitHub for that week. The rapid influx of community contributions — adding tools for repos, issues, PRs, GitHub Actions, and Projects — eventually pushed the server beyond 100 tools. Morrow cites LangChain research published in February 2024 demonstrating that more tools shoved directly into the context window degrades agent performance, causing confusion and context blowout, exactly the symptoms GitHub observed.

To address tool proliferation, Morrow implemented "tool sets" — logical groupings of related tools that users can selectively enable — and a dynamic tool discovery mechanism allowing agents to discover and activate tool groups on demand. A RAG-based semantic tool search prototype was also built but never released. Despite these options, the vast majority of users kept default settings, illustrating a recurring theme: elegant configuration solutions fail when users won't configure them. The talk notes that MCP specification proposals for native tool grouping have been repeatedly rejected, leaving server authors to paper over client-side gaps.

Context optimization produced concrete results. By focusing tools on the general case and grouping CRUD operations, GitHub achieved a 49% reduction in initial context load, settling on roughly 40 tools in the default configuration. A subsequent push to trim API output tokens reduced token usage on the list pull requests tool by over 75%. Tool call success rates now exceed 95%, improved by encoding agent intent directly into the tool surface — for example, performing multiple underlying API calls server-side to avoid round trips and wasted context.

GitHub also introduced systematic evals, testing tool descriptions against each other to ensure tools are invoked at the right times and not incorrectly competing for agent selection. The goal is calibrated tool descriptions rather than maximizing individual call rates.

On security, Morrow describes widespread misuse of plain-text, long-lived, over-privileged personal access tokens stored in agent-accessible locations. GitHub's remote MCP server implements OAuth 2.1 with PKCE — Morrow's team contributed PKCE support directly to GitHub's authorization server. Dynamic client registration was deliberately rejected due to unbounded app database growth, unclear rate-limit bucketing, and unreliable app identity; GitHub is exploring client ID metadata instead. OAuth scopes are used to dynamically filter available tools: PAT tokens immediately restrict the tool surface to matching scopes, while OAuth supports step-up scoping so agents can interactively request additional permissions mid-session rather than failing. Morrow also addressed the Invariant Labs prompt injection exfiltration attack, noting it affects virtually all agentic setups regardless of MCP and represents an unsolved industry-wide problem.

For scalability, the server is fully stateless with Redis handling session storage, serving around 7 million (approaching 8 million) tool calls per week with no session affinity. A new server instance is constructed per request, dynamically assembling the tool set based on user configuration and policy.

An "Insiders" mode exposes experimental features including MCP apps with human-in-the-loop UX, allowing users to review and edit AI-generated issues or PRs before submission. Looking forward, Morrow anticipates compositional tool use (piping tools similar to Unix pipes), automatic server discovery, and autonomous OAuth and tool selection — pointing to Cloudflare's code mode, Anthropic's tool search API in Claude Code, and a similar OpenAI API as early signals. He expects thousands of tools to become normal as current proliferation problems are resolved, potentially reversing many of the context-reduction decisions made today. The project has accumulated over 11 million Docker downloads, nearly 30,000 GitHub stars, 126 contributors, over 2,300 issues and PRs, and nearly 4,000 forks.

Key Takeaways

•More tools in the context window degrades agent performance — LangChain research and GitHub's own data confirm agents get confused and forgetful above ~40 tools in context.
•Group tools into configurable 'tool sets' rather than loading all tools by default; a 49% context reduction was achieved at GitHub by focusing tools on the general case and grouping CRUD operations.
•Trimming API output tokens aggressively pays off — GitHub cut tokens for list pull requests responses by over 75% by tailoring exactly which fields are returned.
•Encode agent intent into tool design: perform multiple underlying API calls server-side to avoid round trips, saving context and improving tool call success rates above 95%.
•Test tool descriptions as a pool using evals — the goal is calibrated selection (called at the right times), not maximizing individual tool call rates.
•Use OAuth 2.1 with PKCE rather than plain-text PATs; plain-text tokens are long-lived, over-privileged, and frequently accessible to the agent — a major attack surface.
•Reject dynamic client registration if it causes unbounded app database growth and unclear rate-limit identity; explore client ID metadata as a cleaner alternative.
•Filter available tools dynamically via OAuth scopes; implement step-up OAuth so agents can request additional scopes interactively rather than failing hard.
•Build stateless MCP servers from the start — construct a fresh server instance per request with tools assembled dynamically, and use Redis for session storage to enable horizontal scaling.
•Prompt injection exfiltration attacks (e.g., Invariant Labs) apply to virtually all agentic setups, not just GitHub's MCP server; it is an unsolved industry-wide problem.

Transcript

[music] >> All right. Hello, London. >> [applause] >> And I hope everyone's been enjoying the AI Engineer Europe so far. For there's so many amazing speakers. I've been like watching talks and talking to people for days now and it's been immense. I'm Sam. I lead development of GitHub's MCP server and yeah, I'm here to talk about mostly challenges we've faced building and scaling our remote server, how we've overcome them, and uh before I will start, I just like I like messing with people. So, yo...