ars-nova-github-max

Gloves-off GitHub MCP server for Claude custom connectors. Full REST + GraphQL passthrough, so it can do anything GitHub's API can do — including the three operations the stock github-mcp-server has never had:

• delete_branch
• create_release
• upload_release_asset

Built 2026-08-13 to replace the github connector entry in Claude Desktop.

Why it exists

The stock GitHub MCP server has no branch-deletion tool in any toolset, and its release tools are read-only (list_releases, get_latest_release, get_release_by_tag). That gap was hit twice during plugin release work.

Rather than hand-write the three missing tools, this server exposes gh_api — an any-method, any-path REST passthrough. It therefore covers every endpoint GitHub has now and everything they ship later, with no code change here. The named tools are thin conveniences over that same primitive.

Deliberately not a local stdio server: the Cloud Run version keeps working when the laptop is off, and — the deciding factor — scheduled tasks run in fresh cloud sessions with no desktop attached, so a local connector is invisible to them.

Design notes

Follows the ars-nova-gcloud-mcp pattern (see claude/infra/ANS_gcloud_MCP_Build.md): stateless Streamable HTTP transport, one Server + transport per request, ?key= token auth, MCP_DISABLED kill switch, single-line JSON audit records on stdout.

One difference worth knowing. The gcloud MCP's headline safety property is "no shell, ever" — it spawns binaries with an argv array so metacharacters stay inert. This server never spawns a process at all; every operation is an HTTPS request built from structured fields. There is no command-injection surface.

What replaces it as the thing to get right is authorization scope, because the token is a full org read/write PAT. Two guards cover that:

Org allowlist. Requests are refused unless they target an allowlisted owner (GITHUB_ALLOWED_OWNERS, default ArsNovaSingers). Endpoints scoped to the token itself — /user, /rate_limit, /search/* — carry no third-party owner and pass through.

Confirm gate. Four irreversible operations require an exact typed phrase, which the error message states:

Operation	Required phrase
DELETE /repos/{owner}/{repo}	DELETE REPO {owner}/{repo}
DELETE /orgs/{org}/members/{user}	REMOVE MEMBER {user}
POST /repos/{owner}/{repo}/transfer	TRANSFER {owner}/{repo}
DELETE /orgs/{org}	DELETE ORG {org}

Branch deletion is deliberately not gated — tidying branches is the whole point, and a deleted branch is recoverable by re-creating a ref at its old SHA. Repository deletion is not recoverable, which is why it is.

Environment

Var	Required	Purpose
MCP_AUTH_TOKEN	yes	Connector token; sent by Claude as ?key=. Server refuses to start without it.
GITHUB_TOKEN	yes	Fine-grained PAT. Server refuses to start without it.
GITHUB_ALLOWED_OWNERS	no	Comma-separated. Default ArsNovaSingers.
MCP_DISABLED	no	1 disables every tool while leaving the service up and diagnosable.

Kill switch

gcloud run services update ars-nova-github-max \
  --region us-central1 --project ars-nova-org-mcp \
  --update-env-vars MCP_DISABLED=1

Tools

Tool	Purpose
gh_api	Any REST endpoint, any method. The gloves-off primitive.
gh_graphql	Query or mutation. For Projects v2, cross-repo reads, discussions.
delete_branch	The operation that motivated this build.
create_release	Required by PROJECT_RULES §5 — nothing ships without a release.
upload_release_asset	Attach the plugin .zip to that release. Base64 in.
whoami	Confirm identity and allowlist. Run this first.

Known limitation

The org allowlist cannot be structurally enforced on arbitrary GraphQL, since the owner lives inside a free-form query document. gh_graphql logs every call and flags mutations in the audit trail. Prefer gh_api for writes where a REST equivalent exists.