Add official read-only GitHub MCP

platform/mcp/compose.yaml

@@ -137,6 +137,29 @@ services:
       - /config:rw,noexec,nosuid,nodev,size=4m,mode=0700
     networks: [tools, egress]
 
+  mcp-github:
+    <<: *tool-common
+    build:
+      context: .
+      dockerfile: Dockerfile.github
+    image: mike-ai/mcp-github:github-v1.10.1-supergateway-v3.4.3
+    container_name: mike-ai-mcp-github
+    profiles: [github]
+    env_file:
+      - ${GITHUB_MCP_ENV_FILE:-/etc/mike-ai/github-mcp.env}
+    environment:
+      # These server-side limits remain authoritative even if a client asks
+      # for broader toolsets. The token itself must also remain read-only.
+      GITHUB_TOOLS: search_repositories,get_repository_tree,get_file_contents,search_code
+      GITHUB_READ_ONLY: "1"
+    networks: [tools, egress]
+    healthcheck:
+      test: ["CMD", "node", "-e", "const s=require('net').connect(8000,'127.0.0.1');s.setTimeout(2000);s.on('connect',()=>{s.end();process.exit(0)});s.on('error',()=>process.exit(1));s.on('timeout',()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 15s
+
   mcp-unraid-official:
     <<: *tool-common
     image: debian:13-slim