Openclaw Github MCP Install

OpenClaw GitHub MCP Install

Use this skill when an OpenClaw bot needs only GitHub MCP setup or troubleshooting. This skill intentionally excludes Google OAuth and other onboarding steps.

Operating Modes

• Prep only — inspect, explain, and prepare, but do not save secrets or modify live MCP config.
• Live install — install/configure GitHub MCP now.
• Repair — diagnose and repair an existing GitHub MCP install.
• Rollback — remove live MCP config and move live artifacts to recoverable trash.

If the request is ambiguous, default to prep-only until the user clearly authorizes live install or repair.

First Response Contract

Before making changes, explicitly confirm:

1. Prep-only, live install, repair, or rollback?
2. Read-only or write-capable?
3. Public-only, selected private repos, or broad private repo access?
4. Is local secret storage under ~/.openclaw/secrets/ authorized on this host?

First Questions

Before configuring anything, ask:

1. Which human/operator owns this bot?
2. Which GitHub user or organization should this bot connect to?
3. Should access be public-only, selected private repos, or broad private repo access?
4. Should the bot be allowed to perform write actions after explicit approval, or read-only only?
5. Is this a fresh GitHub MCP install or a repair of an existing one?
6. Should the bot only prepare the install plan, or perform the live install now?

Never assume the current gh login, SSH key, local git remote, or another bot's token is the intended GitHub identity.

Safety Rules

• Use GitHub's official MCP server as the source of truth: https://github.com/github/github-mcp-server
• Never paste, print, commit, or summarize GitHub tokens, PATs, OAuth tokens, private keys, or generated configs containing secrets.
• Store credentials via OpenClaw/Gateway secret handling when available, or under ~/.openclaw/secrets/ with chmod 600.
• Verify the authenticated GitHub identity before using repo access.
• Do not delete repos, change visibility, force-push, merge PRs, publish releases, change repo settings, or perform destructive writes without explicit approval for the exact action.

Files in This Skill

• references/github-mcp-openclaw.md — OpenClaw-specific setup, verification, and troubleshooting notes.
• references/install-nuances.md — specific pitfalls encountered while setting up GitHub access for OpenClaw bots.

Read references/github-mcp-openclaw.md before installing or repairing GitHub MCP. Read references/install-nuances.md when troubleshooting auth or tool-loading problems.

Standard Workflow

1. Confirm target GitHub account/org and desired repo scope.
2. Confirm whether the task is prep-only, live install, repair, or rollback.
3. Open the official GitHub MCP server docs and follow the current install/auth path.
4. For OpenClaw-managed MCP config, prefer openclaw mcp set / openclaw mcp unset.
5. Configure the MCP server in OpenClaw using a stable server name such as github or github-official.
6. Reload/restart only as required by OpenClaw's current MCP configuration path.
7. Verify MCP tools load.
8. Verify the authenticated GitHub identity and expected repo visibility.
9. Run a harmless read operation.
10. If writes are needed, test on a safe test repo/branch before using production repos.
11. Document only safe facts in the bot's TOOLS.md.

Install Profiles

Prefer one of these explicit profiles:

• read-only
• write-capable with explicit per-action approval
• repair existing install
• rollback existing install

Final Report

Report:

• MCP server name
• GitHub account/org connected
• Access scope verified
• Tool-loading status
• Harmless read test result
• Any blocked permissions or missing scopes
• Safety boundaries for future writes
• Whether the result is prep-only, live, repaired, or rolled back