Docs lead stdio/Cursor install with OAuth (GITHUB_OAUTH_CALLBACK_PORT) but no released image supports it → misleading GITHUB_PERSONAL_ACCESS_TOKEN not set

[amin-tabrizian]

Docs lead stdio/Cursor install with OAuth (GITHUB_OAUTH_CALLBACK_PORT) but no released image supports it → misleading GITHUB_PERSONAL_ACCESS_TOKEN not set

Summary

The install guides on main (e.g. docs/installation-guides/install-cursor.md) now lead the local/stdio setup with an OAuth login config that passes GITHUB_OAUTH_CALLBACK_PORT instead of a PAT. But this feature is not in any released image. The latest release/tag is v1.4.0 (2026-06-18), and ghcr.io/github/github-mcp-server:latest resolves to it. The OAuth code (#2704) and the OAuth-first docs (#2717, #2776) merged to main on 2026-06-26 — after the release.

Result: anyone copying the documented OAuth config and pulling the current latest image gets a confusing, OAuth-unrelated error:

Error: GITHUB_PERSONAL_ACCESS_TOKEN not set

The error never mentions OAuth or a version requirement, so it's hard to diagnose.

Reproduction

Using the OAuth config from the docs:

docker pull ghcr.io/github/github-mcp-server   # -> v1.4.0 (latest)
docker run -i --rm -p 127.0.0.1:8085:8085 -e GITHUB_OAUTH_CALLBACK_PORT=8085 \
  ghcr.io/github/github-mcp-server

Actual: Error: GITHUB_PERSONAL_ACCESS_TOKEN not set and the server exits.
Expected (per docs): browser-based OAuth login on first use, tokens kept in memory.

Confirmed it is not insiders-gated either:

docker run -i --rm -p 127.0.0.1:8085:8085 -e GITHUB_OAUTH_CALLBACK_PORT=8085 \
  ghcr.io/github/github-mcp-server stdio --insiders
# -> same "GITHUB_PERSONAL_ACCESS_TOKEN not set"

The v1.4.0 binary's help has no OAuth/callback/browser-login flag (only an unrelated list-scopes), i.e. the feature isn't compiled into the released image.

Evidence (release vs. merge chronology)

Item	When
v1.4.0 published (latest release & :latest)	2026-06-18 12:46 UTC
#2704 feat(oauth): add stdio OAuth 2.1 login core library (1/4) merged to main	2026-06-26 09:59 UTC
#2717 docs(oauth): stdio OAuth login guide + OAuth-first install config (4/4) merged	2026-06-26
#2776 docs: lead local/stdio install with OAuth login merged to main	2026-06-26 12:45 UTC
Newest tag	still v1.4.0 (no tag contains the OAuth work)

Environment

• Image: ghcr.io/github/github-mcp-server:latest → version label 1.4.0, revision 4f73cfd, created 2026-06-18
• Docker 28.4.0, macOS (Darwin 25.5.0)
• Client: Cursor (config from docs/installation-guides/install-cursor.md, "Local Docker with OAuth")

[SamMorrowDrums]

Hi @amin-tabrizian Unfortunately the way repositories with releases work is that until a release is cut, there is a race condition where docs on main are ahead.

ghcr.io/github/github-mcp-server:main supports this, I'd love you to try it.

[SamMorrowDrums]

Cut a release.