Sam Morrow is a senior software engineer at GitHub leading development of the GitHub MCP Server, open-source infrastructure that connects AI agents to repositories, issues, pull requests, and other developer tools. His work on GitHub Copilot’s agent services and the Model Context Protocol addresses a central challenge of useful autonomy: giving agents powerful capabilities without overwhelming their context windows, exposing sensitive information, or surrendering human control.
A former professional drummer, Morrow began his software career at the BBC in Belfast, building internal tools, quiz-show applications, and web experiences. At IntelliSense.io in Cambridge, he worked on industrial data systems, machine learning, real-time analytics, and Kubernetes infrastructure spanning cloud and on-premises environments.
He subsequently spent four years as a senior software engineer at Jump, developing its jobs platform across Django, React, analytics, and search. He joined GitHub in 2021, initially working on code-scanning security before moving into Copilot Agent Services and leading its official MCP server.
Building agents that know their limits
- Progressive tool discovery: Loading every available tool simultaneously consumes context and degrades agent performance. Morrow favors configurable toolsets, permission-aware filtering, deferred loading, and semantic discovery. His writing on progressive discovery places much of the responsibility on how agent clients expose tools, not on MCP itself.
- Execution models matched to the task: Structured skills suit procedural workflows; command-line access supports investigation; sandboxed execution enables aggregation while keeping intermediate data outside the context window. His comparative experiments treat these approaches as complementary, without claiming a universal winner.
- Authorization that preserves user control: Morrow supports OAuth, PKCE, permission-filtered tool inventories, and incremental authorization that requests additional access only when necessary. His MCP tool-resolution proposal explores exposing permissions, side effects, and execution requirements before invocation.
- Security boundaries and human accountability: Morrow treats prompt injection and data exfiltration as ecosystem-wide consequences of combining untrusted content, private information, and externally consequential tools. His trust-and-sensitivity proposal addresses information boundaries, while reviewable AI-generated GitHub issues preserve human-in-the-loop workflows. His AI Engineer Europe presentation also details intent-oriented tool design and stateless server architecture.
Beyond GitHub, Morrow maintains a reMarkable MCP server for tablet documents and highlights, alongside a Python MCP starter for developers building their own servers.
