GitHub Security MCP

GitHub security posture analysis for AI agents.

GitHub Enterprise security features cost $21/user/month.

This gives your AI agent the same visibility for free — org, repos, Actions, secrets, supply chain.

The Problem • How It's Different • Quick Start • What The AI Can Do • Tools • Checks • Architecture

______________________________________________________________________

问题

GitHub的安全性是分散的。您需要单独的工具来进行组织设置、仓库配置、操作工作流分析、秘密扫描、供应链和访问控制。没有一个工具能涵盖这一切，也没有一个能与人工智能代理配合使用。

Traditional workflow:
  manually check org settings                →  click through 15 pages
  run github-advisory-db for each repo       →  one at a time
  grep workflows for script injection        →  miss half the patterns
  review collaborator access                 →  spreadsheet hell
  check secret scanning alerts               →  another dashboard
  ──────────────────────────────────────────
  Total: hours of manual work per org

github安全mcp 为您的AI代理提供39个工具和45个安全检查 模型上下文协议.代理直接调用GitHub API，了解它发现了什么，并告诉您要修复什么。

With github-security-mcp:
  You: "Audit my GitHub org for security issues and prioritize the fixes"

  Agent: → checks org settings (2FA, SSO, member privileges)
         → scans repos (branch protection, secret scanning, Dependabot)
         → analyzes workflows (script injection, unpinned actions, OIDC)
         → reviews access (teams, collaborators, PATs, GitHub Apps)
         → "12 critical, 8 high — here are the top 5 to fix now"

______________________________________________________________________

这有什么不同

现有的工具专注于GitHub安全的一个方面。github security-mcp覆盖了整个堆栈，可以与任何AI代理配合使用。

Existing Tools github-security-mcp

Interface CLI / GitHub UI / dashboards MCP — AI agent calls tools in real-time

Scope Single domain (Actions, or secrets, or repos) Full stack: org + repos + Actions + secrets + supply chain + access

Correlation None — isolated findings Agent chains: "This unpinned action + write permissions + no environment protection = supply chain risk"

Remediation Generic docs links Agent generates specific fix instructions for your exact configuration

Actions analysis Most tools skip workflows 8 checks: script injection, PR target, OIDC, pinning, secrets, runners, environments, permissions

Enterprise features Require GitHub Enterprise ($21/user/mo) Free — uses public API with graceful degradation for Enterprise-only features

Specific comparisons with popular tools

所有这些都是优秀的工具。github安全mcp并没有取代它们——它填补了提供人工智能代理的空白 统一、交互式访问 跨所有GitHub安全域。

______________________________________________________________________

快速开始

安装

git clone https://github.com/badchars/github-security-mcp.git
cd github-security-mcp
bun install

设置身份验证

# Classic PAT (requires: repo, admin:org, admin:org_hook, admin:repo_hook)
export GITHUB_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Fine-grained PAT (preferred — least privilege)
# Organization: Members (read), Administration (read)
# Repository: Administration, Code scanning, Dependabot, Secret scanning,
#             Actions, Environments, Webhooks (all read-only)

连接到您的AI代理

Claude Code

claude mcp add github-security -- bun run /path/to/github-security-mcp/src/index.ts

Claude Desktop

增添 ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "github-security": {
      "command": "bun",
      "args": ["run", "/path/to/github-security-mcp/src/index.ts"],
      "env": {
        "GITHUB_TOKEN": "ghp_your_token_here"
      }
    }
  }
}

Cursor / Windsurf / other MCP clients

相同的JSON配置格式。将命令指向您的安装路径。

开始审核

You: "Audit my GitHub org for security misconfigurations"

就这样，剩下的就交给特工了。

______________________________________________________________________

AI能做什么

全面组织审计

You: "Run a complete security audit on our GitHub org"

Agent: → github_run_all {org: "myorg", repo: "main-app"}
       → 45 checks across 6 categories
       → github_audit_report
       → "34 findings: 4 critical, 7 high, 12 medium.
          Critical #1: No branch protection on main (REPO-001)
          Critical #2: Script injection in deploy.yml (ACT-001)
          Critical #3: 3 critical Dependabot alerts unfixed 90+ days (REPO-007)
          Critical #4: Unresolved secret scanning alerts (SEC-002)
          Here are the exact fixes for each..."

操作工作流安全

You: "Check our CI/CD workflows for supply chain risks"

Agent: → github_check_workflow_injection
         Found ${{ github.event.issue.title }} in run: block (deploy.yml:47)
       → github_check_workflow_pinning
         12 actions use tags instead of SHA pins
       → github_check_workflow_pr_target
         build.yml uses pull_request_target with checkout — critical risk
       → github_check_workflow_permissions
         Default GITHUB_TOKEN has write-all permissions
       → "4 supply chain risks found. The PR target + checkout pattern
          allows any fork to execute arbitrary code with write access
          to your repo. Fix this first."

访问控制审查

You: "Who has too much access to our repositories?"

Agent: → github_check_team_permissions
         "platform" team has admin on 47 repos, only 3 members
       → github_check_collaborators
         8 outside collaborators with write access
       → github_check_app_permissions
         "old-ci-bot" GitHub App has admin + all repos
       → github_check_pat_usage
         14 classic PATs with repo scope (should be fine-grained)
       → "Reduce blast radius: restrict platform team to maintain,
          remove 3 stale outside collaborators, limit old-ci-bot
          to specific repos, migrate classic PATs to fine-grained."

秘密曝光检测

You: "Are we properly protecting secrets across our repos?"

Agent: → github_check_secret_scanning
         Secret scanning disabled on 5 private repos
       → github_check_push_protection
         3 push protection bypasses in the last month
       → github_check_secret_patterns
         No custom secret patterns defined
       → github_check_secret_scoping
         2 org secrets available to all repos (should be scoped)
       → "Enable secret scanning on all repos, review the 3 bypasses,
          add custom patterns for internal API keys, and scope
          org secrets to only the repos that need them."

______________________________________________________________________

工具参考（39个工具）

Organization (7)

Repository (8)

Actions (8)

Secrets (4)

Supply Chain (4)

Access Control (4)

Meta (4)

______________________________________________________________________

检查注册表（45次检查）

Organization (ORG-001 to ORG-010)

Repository (REPO-001 to REPO-013)

Actions (ACT-001 to ACT-008)

Secrets (SEC-001 to SEC-005)

Supply Chain (SUP-001 to SUP-005)

Access Control (ACC-001 to ACC-004)

______________________________________________________________________

建筑

src/
├── index.ts                    Entry point + MCP stdio
├── types/
│   └── index.ts                CheckResult, ToolDef, ToolContext, ToolResult
├── github/
│   └── client.ts               GitHubClientFactory (lazy Octokit + GraphQL)
├── protocol/
│   ├── tools.ts                39 tool definitions (Zod schemas)
│   └── mcp-server.ts           MCP server + stdio transport
├── org/                        Organization checks (ORG-001..010)
│   ├── security.ts             2FA, visibility, member privileges
│   ├── sso.ts                  SSO/SAML via GraphQL
│   ├── members.ts              Outside collaborators, stale members
│   ├── apps.ts                 OAuth apps, GitHub App installations
│   ├── webhooks.ts             Insecure webhook URLs
│   └── audit-log.ts            Suspicious audit log patterns
├── repo/                       Repository checks (REPO-001..013)
│   ├── branch-protection.ts    Branch protection rules
│   ├── secret-scanning.ts      Secret scanning + push protection
│   ├── code-scanning.ts        CodeQL enabled, open alerts
│   ├── dependabot.ts           Dependabot enabled, critical alerts
│   ├── settings.ts             SECURITY.md, vuln reporting, forks
│   ├── webhooks.ts             Insecure repo webhooks
│   ├── deploy-keys.ts          Deploy key permissions
│   └── codeowners.ts           CODEOWNERS file
├── actions/                    GitHub Actions checks (ACT-001..008)
│   ├── injection.ts            Script injection via untrusted inputs
│   ├── pr-target.ts            pull_request_target + checkout
│   ├── permissions.ts          GITHUB_TOKEN default permissions
│   ├── pinning.ts              Unpinned third-party actions
│   ├── runners.ts              Self-hosted runner exposure
│   ├── environments.ts         Environment protection rules
│   ├── secrets.ts              Secret exfiltration patterns
│   └── oidc.ts                 OIDC configuration
├── secrets/                    Secret management checks (SEC-001..005)
│   ├── scanning.ts             Coverage + alert triage
│   ├── push-protection.ts      Push protection bypasses
│   ├── patterns.ts             Custom secret patterns
│   └── scoping.ts              Env/repo/org secret scoping
├── supply-chain/               Supply chain checks (SUP-001..005)
│   ├── dependency-graph.ts     Dependency graph enabled
│   ├── dependabot-updates.ts   Security updates config
│   ├── sbom.ts                 SBOM generation
│   └── vulnerabilities.ts      Known vulns, stale unfixed
├── access/                     Access control checks (ACC-001..004)
│   ├── teams.ts                Team permission audit
│   ├── collaborators.ts        External collaborators
│   ├── github-apps.ts          GitHub App permissions
│   └── tokens.ts               Classic vs fine-grained PATs
└── meta/                       Aggregation + reporting
    ├── list-checks.ts          CHECK_REGISTRY (45 checks)
    ├── summary.ts              Findings aggregation
    ├── report.ts               Markdown/JSON report
    └── run-all.ts              Execute all checks

设计决策：

• 单个Octokit实例 -GitHub API是全球性的（无地区）。在第一个API调用上的延迟初始化。
• 统一检查结果 --每次检查都返回相同的结构：checkId、严重性、状态、详细信息、补救措施。图案与 云审计mcp.
• 静态工作流分析 -操作检查通过Contents API获取YAML并使用regex分析。GitHub没有解析的工作流API。
• 企业优雅降级 --仅限企业的功能（审核日志、凭据授权、SSO）返回 NOT_APPLICABLE 而不是错误。
• 记忆中的发现 --会话范围的发现数组。没有数据库，就没有持久性。跑 github_audit_summary 或 github_audit_report 聚合。
• 4依赖关系 — @modelcontextprotocol/sdk, @octokit/rest, @octokit/graphql, zod没有别的了。

______________________________________________________________________

认证

从读取令牌 GITHUB_TOKEN 环境变量。

______________________________________________________________________

MCP安全套件的一部分

______________________________________________________________________

局限性

• 需要具有适当范围的GitHub PAT或GitHub App令牌
• 一些检查需要GitHub Enterprise Cloud（审计日志、凭据授权、SSO）——这些检查在免费/团队计划中会优雅地返回NOT_APPLICABLE
• 动作工作流分析是基于正则表达式的（没有AST解析）——可能会错过复杂的注入模式
• 速率限制：GitHub API允许通过身份验证的用户每小时请求5000次。一个包含多个仓库的完整组织审计可能会接近这个极限
• macOS/Linux（未测试Windows）

______________________________________________________________________

For authorized security testing and assessment only.

Always ensure you have proper authorization before auditing any organization.

MIT License • Built with Bun + TypeScript