GitHub MCP server and Dome

1. 01

   Add the GitHub MCP server

   Credentials are per user. Dome holds each engineer's GitHub token and injects it on calls made for them.

   $ dome tools add --name github \
     --url https://api.githubcopilot.com/mcp/ \
     --auth-method api-key \
     --credential-type per-user \
     --gateway eng-gateway

2. 02

   Sync the catalog

   Run it once a token is attached, and again when GitHub adds tools. Until then, agents get “tool not available in this gateway”.

   $ dome tools catalog sync github

3. 03

   Apply the rules

   Scope them to one agent while you try them. Simulate before you deploy.

   $ dome rules apply github-permit.cedar github-args.cedar \
     --agent release-drafter --name github-per-argument

Commands and rules tested against a Dome workspace on September 30, 2026. For anything about GitHub itself, see GitHub's documentation.

permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when { resource.connection_name == "github" };
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "github" &&
  resource.tool_name == "merge_pull_request" &&
  resource has arguments &&
  resource.arguments has owner && resource.arguments has repo &&
  resource.arguments.owner == "acme" && resource.arguments.repo == "payments"
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "github" &&
  resource has arguments &&
  resource.arguments has owner && resource.arguments.owner != "acme"
};