| GH_TOKEN | No | gh CLI token. Leave unset to use whatever `gh auth login` already configured (OS keychain). Secret. |
| GH_HOST | No | Target a GitHub Enterprise hostname instead of github.com. |
| GHCLI_MCP_ALLOW_WRITE | No | Set to "true" to permit state-changing gh commands. Defaults to read-only. |
| GHCLI_MCP_ALLOWED_REPOS | No | Optional comma-separated allowlist of "owner/repo" values, enforced when -R/--repo is passed. Unset allows all. |
| GHCLI_MCP_CLI_PATH | No | Optional path to the gh binary. Defaults to "gh" resolved via PATH. |
| GH_TOKEN | No | gh CLI token. Leave unset to use whatever `gh auth login` already configured (OS keychain). Secret. |
| GH_HOST | No | Target a GitHub Enterprise hostname instead of github.com. |
| GHCLI_MCP_ALLOW_WRITE | No | Set to "true" to permit state-changing gh commands. Defaults to read-only. |
| GHCLI_MCP_ALLOWED_REPOS | No | Optional comma-separated allowlist of "owner/repo" values, enforced when -R/--repo is passed. Unset allows all. |
| GHCLI_MCP_CLI_PATH | No | Optional path to the gh binary. Defaults to "gh" resolved via PATH. |
| GH_TOKEN | No | gh CLI token. Leave unset to use whatever `gh auth login` already configured (OS keychain). Secret. |
| GH_HOST | No | Target a GitHub Enterprise hostname instead of github.com. |
| GHCLI_MCP_ALLOW_WRITE | No | Set to "true" to permit state-changing gh commands. Defaults to read-only. |
| GHCLI_MCP_ALLOWED_REPOS | No | Optional comma-separated allowlist of "owner/repo" values, enforced when -R/--repo is passed. Unset allows all. |
| GHCLI_MCP_CLI_PATH | No | Optional path to the gh binary. Defaults to "gh" resolved via PATH. |
| GH_TOKEN | No | gh CLI token. Leave unset to use whatever `gh auth login` already configured (OS keychain). Secret. |
| GH_HOST | No | Target a GitHub Enterprise hostname instead of github.com. |
| GHCLI_MCP_ALLOW_WRITE | No | Set to "true" to permit state-changing gh commands. Defaults to read-only. |
| GHCLI_MCP_ALLOWED_REPOS | No | Optional comma-separated allowlist of "owner/repo" values, enforced when -R/--repo is passed. Unset allows all. |
| GHCLI_MCP_CLI_PATH | No | Optional path to the gh binary. Defaults to "gh" resolved via PATH. |
| GH_TOKEN | No | gh CLI token. Leave unset to use whatever `gh auth login` already configured (OS keychain). Secret. |
| GH_HOST | No | Target a GitHub Enterprise hostname instead of github.com. |
| GHCLI_MCP_ALLOW_WRITE | No | Set to "true" to permit state-changing gh commands. Defaults to read-only. |
| GHCLI_MCP_ALLOWED_REPOS | No | Optional comma-separated allowlist of "owner/repo" values, enforced when -R/--repo is passed. Unset allows all. |
| GHCLI_MCP_CLI_PATH | No | Optional path to the gh binary. Defaults to "gh" resolved via PATH. |
| GH_TOKEN | No | gh CLI token. Leave unset to use whatever `gh auth login` already configured (OS keychain). Secret. |
| GH_HOST | No | Target a GitHub Enterprise hostname instead of github.com. |
| GHCLI_MCP_ALLOW_WRITE | No | Set to "true" to permit state-changing gh commands. Defaults to read-only. |
| GHCLI_MCP_ALLOWED_REPOS | No | Optional comma-separated allowlist of "owner/repo" values, enforced when -R/--repo is passed. Unset allows all. |
| GHCLI_MCP_CLI_PATH | No | Optional path to the gh binary. Defaults to "gh" resolved via PATH. |