Github Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Github Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP (Model COntext Protocol) server that gives AI assistants direct access to GitHub. Exposing ~22 GitHub REST tools covering repos, files, issues, pull requests, as well as searching.
A single stdio MCP server (built on FastMCP) exposing 23 GitHub REST tools grouped into four areas:
github_list_repos, github_get_repo, github_list_branches, github_list_commits, github_get_file_contents, github_list_directory, github_create_or_update_file, github_create_branchgithub_list_issues, github_get_issue, github_create_issue, github_update_issue, github_add_issue_commentgithub_list_pull_requests, github_get_pull_request, github_create_pull_request, github_merge_pull_request, github_add_pr_commentgithub_search_repositories, github_search_code, github_search_issues, github_search_users, github_search_commitsUnder the hood:
httpx.AsyncClient against the pinned GitHub API version (2022-11-28).Link: rel="next" header up to a configurable item cap.GITHUB_TOKEN, falling back to GITHUB_PAT.Python 3.12 or latermcp[cli]>=1.0.0, httpx>=0.27.0, pydantic>=2.0.0 (see pyproject.toml) (project uses poetry for dependency management)pip install github-mcp
# or using poetry
poetry add github-mcpgit clone https://github.com/LWaetzig/github-mcp.git
cd github-mcp
pip install -e .#### Create a fine-grained Personal Access Token (PAT)
| Permission | Access level | Used by tools |
|---|---|---|
| Metadata | Read-only | All tools |
| Contents | Read and write | github_get_file_contents, github_list_directory, github_list_commits, github_create_or_update_file, github_create_branch |
| Issues | Read and write | github_list_issues, github_get_issue, github_create_issue, github_update_issue, github_add_issue_comment |
| Pull requests | Read and write | github_list_pull_requests, github_get_pull_request, github_create_pull_request, github_merge_pull_request, github_add_pr_comment |
Read-only subset: grant only Read-only access to Contents, Issues, Pull requests, and Metadata if you don't need write tools.
export GITHUB_TOKEN=github_pat_...Or copy .env.example -> .env and fill in the token (load with source .env).
Add the server to your Claude Desktop configuration:
| Platform | Path |
|---|---|
| macOS | ~/Library/Application Support/Claude/claude_desktop_config.json |
| Windows | %APPDATA%\Claude\claude_desktop_config.json |
Add the github entry under mcpServers, replacing the path with the absolute path to your clone:
{
"mcpServers" : {
"github" : {
"command" : "python",
"args" : ["-m", "github-mcp"],
"env" : {
"GITHUB_TOKEN" : "github_pat_..."
}
}
}
}Restart Claude Desktop. You should see the github tools available int he tool picker.
Any MCP client (e.g. Cline, GitHub Copilot, or custm tools) can use this server. Configuration depends on your assistant, in most cases there is a config to change.
Contributions are welcome! Please:
git checkout -b feature/your-feature)GITHUB_TOKEN=...
npx @modelcontextprotocol/inspector
uv run github-mcpThen call github_search_repositories (q="mcp language:python") or github_get_repo (owner="modelcontextprotocol", repo="python-sdk") to verify auth, pagination, and formatting end-to-end.
/graphql). Add a graphql_client.py alongside client.py and a new tools/projects.py module.tools/actions.py importing from client.py.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.