GitHub OAuth: Authentication for MCPM Explained
mcpm uses GitHub OAuth — no new account, no new password. This guide explains how authentication works and how to manage it.
Why GitHub OAuth?
- No new account — use your existing GitHub identity
- No password to remember — one-click auth
- Secure — industry-standard OAuth 2.0
- Your tools stay yours — publishing is tied to your GitHub profile
First-Time Login
mcpm-dev login
What happens:
- Your browser opens to
https://www.mcpm.dev/cli-login
- GitHub asks you to authorize mcpm
- You click "Authorize"
- A CLI token is generated and stored locally
- You're authenticated!
What mcpm Accesses
mcpm requests minimal GitHub permissions:
- Read your public profile — name, avatar, username
- Read your email — for account identification only
mcpm cannot:
- Access your private repos
- Modify anything on GitHub
- See your GitHub credentials
Token Management
Where Tokens Are Stored
- macOS/Linux:
~/.mcpm/auth.json
- Windows:
%USERPROFILE%\.mcpm\auth.json
Check Token Status
mcpm-dev whoami
Output:
Logged in as: xapable
Token expires: August 7, 2026
Token Expiry
Tokens are valid for 30 days. The CLI warns you 7 days before expiry:
⚠️ Your mcpm token expires in 6 days. Run `mcpm-dev login` to refresh.
Refreshing Your Token
mcpm-dev login
This generates a fresh 30-day token. Your old token is invalidated.
Logging Out
mcpm-dev logout
This removes your token locally. Your published packages remain on mcpm.
Multiple Machines
You can be logged in on multiple machines simultaneously. Each gets its own token.
mcpm-dev login
mcpm-dev login
Both tokens work independently.
CI/CD Authentication
For automated publishing (GitHub Actions, etc.):
- Generate a token via the web: https://www.mcpm.dev/settings/tokens
- Store it as a secret in your CI:
- name: Publish to mcpm
run: mcpm-dev publish
env:
MCPM_TOKEN: ${{ secrets.MCPM_TOKEN }}
Troubleshooting
| Problem |
Solution |
| "Browser didn't open" |
Use mcpm-dev login --no-browser for a manual URL |
| "Token invalid" |
Token expired — run mcpm-dev login |
| "Permission denied" |
You may be using a different GitHub account |
| "Rate limited" |
Wait a few minutes — GitHub enforces rate limits |
Security Best Practices
- Don't share tokens — they're like passwords
- Use CI tokens for automation — not your personal token
- Logout on shared machines —
mcpm-dev logout
- Revoke tokens anytime — https://www.mcpm.dev/settings/tokens
GitHub OAuth means one less password to manage. Secure, simple, fast.
#MCP #Tutorial #GitHub #Authentication #mcpm
GitHub OAuth: Authentication for MCPM Explained
mcpm uses GitHub OAuth — no new account, no new password. This guide explains how authentication works and how to manage it.
Why GitHub OAuth?
First-Time Login
What happens:
https://www.mcpm.dev/cli-loginWhat mcpm Accesses
mcpm requests minimal GitHub permissions:
mcpm cannot:
Token Management
Where Tokens Are Stored
~/.mcpm/auth.json%USERPROFILE%\.mcpm\auth.jsonCheck Token Status
mcpm-dev whoamiOutput:
Token Expiry
Tokens are valid for 30 days. The CLI warns you 7 days before expiry:
Refreshing Your Token
This generates a fresh 30-day token. Your old token is invalidated.
Logging Out
mcpm-dev logoutThis removes your token locally. Your published packages remain on mcpm.
Multiple Machines
You can be logged in on multiple machines simultaneously. Each gets its own token.
# On your laptop mcpm-dev login # On your desktop mcpm-dev loginBoth tokens work independently.
CI/CD Authentication
For automated publishing (GitHub Actions, etc.):
# .github/workflows/publish.yml - name: Publish to mcpm run: mcpm-dev publish env: MCPM_TOKEN: ${{ secrets.MCPM_TOKEN }}Troubleshooting
mcpm-dev login --no-browserfor a manual URLmcpm-dev loginSecurity Best Practices
mcpm-dev logoutGitHub OAuth means one less password to manage. Secure, simple, fast.
#MCP #Tutorial #GitHub #Authentication #mcpm