github-write-mcp is a small, single-purpose MCP server that pushes a set of files onto a GitHub branch as one atomic commit — and nothing else. It exists to unblock agent sessions that run in a hosted sandbox behind an egress proxy that blocks direct git push and GitHub API access: because an MCP connector runs hosted rather than inside that sandboxed container, it can reach GitHub over its own channel, using whatever token the caller hands it for that single call.

It ships exactly three tools. github_push_files creates or updates one or more files on a non-default branch using the Git Data API (blob → tree → commit → ref), so a multi-file change lands as a single commit or none at all — never a partial, broken intermediate state. github_read_file reads a file back at a given ref, so a push can be verified before and after. github_list_branches lists a repository's branches and names the default, so a push never lands somewhere by accident.

Every call is BYOK and zero-custody: the caller's GitHub personal access token is a parameter of the call itself, never read from the environment, never written to disk, never logged, and scrubbed from every response and error path. Nothing is cached and nothing is remembered between calls.

The safety model is built for handing this to an autonomous agent unsupervised: it will never write to the repository's default branch, never force-push, only extends an existing branch when it is a fast-forward descendant of its stated base, and refuses anything under .github/workflows/ unless the caller explicitly opts in. Files over 5 MB and pushes over 20 MB are rejected outright, and every check that can be done without a network call runs before any write — so a rejected push leaves nothing behind, not even an orphaned blob.

What it deliberately does not do: open or merge pull requests, delete branches or files, index or search a repository, or hold any state. Its scope ends at the branch — opening the PR is left to the caller.