Github MapperSAFE
MCP GitHub Mapper is a MCP tool that will map any repository remotely and import the map directly into your code editor.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://mseep.ai/app/dazeb-mcp-github-mapper)
[](https://smithery.ai/server/github-mapper-mcp-server)
GitHub Mapper is a Model Context Protocol (MCP) server that provides tools for mapping and analyzing GitHub repositories. It allows users to set a GitHub Personal Access Token and retrieve detailed information about a specified repository, including its structure and summary statistics.
Features
- Set GitHub Personal Access Token for authentication
- Map and analyze GitHub repository structure
- Retrieve repository summary information (stars, forks, language, etc.)
- Provide a detailed repository file structure
Prerequisites
- Node.js (v18.0.0 or later recommended)
- npm (comes with Node.js)
- A GitHub Personal Access Token with appropriate permissions
Installation
Installing via Smithery
To install GitHub Mapper for Claude Desktop automatically via Smithery:
npx -y @smithery/cli install github-mapper-mcp-server --client claude
Manual Installation
- Clone the repository:
git clone https://github.com/your-username/github-mapper-mcp-server.git cd github-mapper-mcp-server
- Install dependencies:
npm install
- Build the project:
npm run build
Usage
- Start the server:
npm start
- The server will run on stdio, allowing it to communicate with MCP clients.
Available Tools
1. set-github-token
Sets the GitHub Personal Access Token for authentication.
- Create your Personal Access Token here. Choose Tokens (classic). Scopes: repo
Example, in your IDE or Claude Desktop
2c791ccbf2f8OBSERVED · 2026-10-09Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add github-mapper-mcp-server -- npx -y [email protected]
{
"mcpServers": {
"github-mapper-mcp-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (2)
1 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
map-github-repo | read | Map a GitHub repository structure and provide summary information |
set-github-token | write | Set the GitHub Personal Access Token for authentication |
Trust audit
SAFEgrade B · trust 88/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (5)
Please set-github-token to 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
.whitesource
@modelcontextprotocol/sdk, @octokit/rest, mcp-evals, @types/node, typescript
The evals package loads an mcp client that then runs the index.ts file, so there is no need to rebuild between tests. You can load environment variables by prefixing the npx command. Full documentatio
Gates applied: no_behavioural_pass, no_license.
2c791ccbf2f8full audit observations/trust-audit/mcp-server/dazeb__github-mapper.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-09 | 2c791ccbf2f8 | SAFE | B | 88 | first audit |
Questions
What is the Github Mapper MCP server?
MCP GitHub Mapper is a MCP tool that will map any repository remotely and import the map directly into your code editor.
What tools does Github Mapper expose?
2 in total: 1 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Github Mapper safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (88/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Github Mapper need?
No credential environment variables were found in its source, so it appears to need none.
How does Github Mapper run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as github-mapper-mcp-server at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (2c791ccbf2f8), read on 2026-10-09. The repository is watched and re-audited when it changes.