GitHub's official remote endpoint is hosted and uses OAuth. That is the one for repos, issues and Actions. The local Docker or binary copy is yours to patch and token. Do not mount both GitHub servers in one session.
In VS Code, use an MCP install link or mcp.json. Visual Studio 2022/2026 accepts the same remote shape. Copilot CLI plugins are a different path: Azure skills go through /plugin, not mcp.json.
A person still has to approve tools. Whatever Copilot can call has the rights of the current GitHub account plus any local command you allowed. See MCP in VS Code and approving tool calls on this site.
Copilot's coding agent in CI is another host. It will read repo-level MCP config. Do not put a laptop-only filesystem server in the team file.