Github Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Github Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A minimal MCP server for GitHub in ~140 lines of Python. Browse repos, read code, search, and get insights — all through natural language via Claude, Cursor, or any MCP client.
| Tool | Description |
|---|---|
list_repos | List repositories with language, stars, and last update |
get_repo_structure | View the file tree of any repo |
get_file | Read any file's content |
search_code | Search code across your repos |
list_issues | Get open/closed issues |
get_commits | Recent commit history |
repo_stats | Languages breakdown, stars, forks, dates |
# Clone
git clone https://github.com/ArnabbLank/github-mcp-server.git
cd github-mcp-server
# Install
pip install -e .
# Configure
cp .env.example .env
# Edit .env with your GitHub token (Settings → Developer settings → Personal access tokens)
# Run
mcp dev server.pyAdd to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"github": {
"command": "python",
"args": ["/path/to/github-mcp-server/server.py"],
"env": {
"GITHUB_TOKEN": "ghp_your_token",
"GITHUB_OWNER": "your_username"
}
}
}
}Restart Claude Desktop. You can now ask things like:
This server implements the Model Context Protocol using fastmcp. Each tool is a Python function decorated with @mcp.tool() — the MCP client (Claude, Cursor) discovers them automatically and calls them when relevant.
┌─────────────┐ MCP (stdio/SSE) ┌──────────────┐ HTTPS ┌────────┐
│ Claude/Cursor│ ◄──────────────────────────► │ server.py │ ◄──────────────► │ GitHub │
│ (MCP Client)│ │ (MCP Server) │ │ API │
└─────────────┘ └──────────────┘ └────────┘@mcp.tool()
async def my_tool(repo: str, owner: str = "") -> str:
"""Description shown to the LLM."""
owner = owner or OWNER
data = await _get(f"/repos/{owner}/{repo}/whatever")
return format_data(data)That's it. The LLM sees the function name, docstring, and parameter types — no extra config needed.
The GitHub token needs these scopes:
repo — for private repo access (optional, skip for public-only)read:user — for listing reposGenerate one at: https://github.com/settings/tokens
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.