MCP server · Org-owned · Audited from source

GitHub MCP server

by github/github-mcp-serverMIT licenceAudited 19 Sep 2026 · source 8bd0df9a61a0

npm @github/mcp-server-ui 1.0.0stdiostreamable-http★ 33,051

!CAUTIONGrade C · 74/100 · 19 Sep 2026 · 8bd0df9

33,051GitHub stars

Is it safe? With care — CAUTION, grade C (74/100). No tools were found in its source. The audit recorded 27 findings (0 critical, 0 high, 5 medium, 22 low). Maintainer's description: GitHub's official MCP Server

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “GitHub MCP server (github/github-mcp-server)”. Retrieved 19 Sep 2026. https://modelsatlas.com/mcp/github/github-15

Trust audit

Audit 0.4.1 · full source read 19 Sep 2026

Trust score74/100!CAUTION C

0 critical0 high5 medium22 low0 info

27 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemNone observedNothing seen in the source
NetworkNone observedNothing seen in the source
ShellNone observedNothing seen in the source
DependenciesNot pinnedSome ranges float
SecretsFoundSee the findings

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	PASS 3 findings
`L1` Static source	Secrets, path traversal, supply chain	WARN 16 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS 6 findings
`L3` Inventory	Declared tools match the source	PASS
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner githubOrganizationAccount type recorded when we read the repository.
PackagePublished on npm@github/mcp-server-ui at version 1.0.0
LicenceMITFrom the repository, as read at the audited commit.
Last push2 days agoActivity of the repository when we read it.
Source commit read8bd0df9a61a0The audit covers exactly this commit, read on 19 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventoryNone declaredNo tools were found in the source.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (27)

Sorted by severity · the 25 most severe of 27 are listed

MEDIUMObfuscation / stealthobf.base64_blob · pkg/github/__toolsnaps__/assign_copilot_to_issue.snap:11

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

"src": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABgAAAAYCAYAAADgdz34AAAABmJLR0QA/wD/AP+gvaeTAAAC20lEQVRIidWUS4wMURSGv3O7kWmPEMRrSMzcbl1dpqtmGuOxsCKECCKxEBusSJhIWEhsWLFAbC1sWFiISBARCyQ2kzSZGaMxHo

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.base64_blob · pkg/github/__toolsnaps__/assign_copilot_to_issue.snap:16

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

"src": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABgAAAAYCAYAAADgdz34AAAABmJLR0QA/wD/AP+gvaeTAAACCElEQVRIid2UPWsUYRSFn3dxWWJUkESiBgslFokfhehGiGClBBQx4h9IGlEh2ijYxh+gxEL/hIWwhYpF8KNZsFRJYdJEiUbjCk

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.base64_blob · pkg/github/__toolsnaps__/assign_copilot_to_issue_with_intent.snap:11

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

"src": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABgAAAAYCAYAAADgdz34AAAABmJLR0QA/wD/AP+gvaeTAAAC20lEQVRIidWUS4wMURSGv3O7kWmPEMRrSMzcbl1dpqtmGuOxsCKECCKxEBusSJhIWEhsWLFAbC1sWFiISBARCyQ2kzSZGaMxHo

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.base64_blob · pkg/github/__toolsnaps__/assign_copilot_to_issue_with_intent.snap:16

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

"src": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABgAAAAYCAYAAADgdz34AAAABmJLR0QA/wD/AP+gvaeTAAACCElEQVRIid2UPWsUYRSFn3dxWWJUkESiBgslFokfhehGiGClBBQx4h9IGlEh2ijYxh+gxEL/hIWwhYpF8KNZsFRJYdJEiUbjCk

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · pkg/http/middleware/pat_scope_test.go:102

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

LOWInventory / provenanceinv.hidden_file · .golangci.yml

F-13 Inventory / provenanceCWE-1104Layer L0

.golangci.yml

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · .goreleaser.yaml

F-13 Inventory / provenanceCWE-1104Layer L0

.goreleaser.yaml

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · pkg/github/ui_dist/.placeholder.html

F-13 Inventory / provenanceCWE-1104Layer L0

.placeholder.html

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWFilesystem / pathfs.traversal · pkg/github/repositories_test.go:644

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

target := "../../outside"

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · pkg/github/repositories_test.go:2403

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

Target: github.Ptr("../../outside"),

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · pkg/github/repositories_test.go:2408

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

Target: github.Ptr("../../outside"),

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · pkg/github/repositories_test.go:2421

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

expectedErrMsg: `"target":"../../outside"`,

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · pkg/github/repositories_test.go:6556

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

{"traversal", "src/../../../etc/passwd", "must not contain '..'"},

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · pkg/utils/api_test.go:76

F-04 Network egressCWE-200 · CWE-319Layer L1

input:       "http://127.0.0.1",

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · pkg/utils/api_test.go:77

F-04 Network egressCWE-200 · CWE-319Layer L1

wantRestURL: "http://127.0.0.1/api/v3/",

Why: No further detail recorded for this rule.
Fix: —

LOWObfuscation / stealthobf.base64_blob · docs/installation-guides/install-cursor.md:40

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

[![Install MCP Server](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=github&config=eyJjb21tYW5kIjoiZG9ja2VyIHJ1biAtaSAtLXJtIC1lIEdJVEhVQl9QRVJTT05BTF9BQ0NFU

Why: No further detail recorded for this rule.
Fix: —

LOWObfuscation / stealthobf.zero_width · pkg/sanitize/sanitize_test.go:863

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

content := "普通 prose with $5 and $x^2$, :rocket:, ✈️, 👩💻.\n\n" +

Why: No further detail recorded for this rule.
Fix: —

LOWObfuscation / stealthobf.zero_width · pkg/sanitize/sanitize_test.go:874

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

require.Equal(t, "✈️ and 👩💻", Content("✈️ and 👩💻"))

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainsupply.unpinned · ui/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@github/markdown-toolbar-element, @modelcontextprotocol/ext-apps, @primer/octicons-react, @primer/react, react, react-dom, react-markdown, remark-gfm

Why: 15 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWPrompt injectionprompt.authority_framing · README.md:1662

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

Lockdown mode limits the content that the server will surface from public repositories. When enabled, the server checks whether the author of each item has push access to the repository. Private repos

Why: No further detail recorded for this rule.
Fix: —

LOWPrompt injectionprompt.authority_framing · docs/server-configuration.md:295

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

Lockdown mode ensures the server only surfaces content in public repositories from users with push access to that repository. Private repositories are unaffected, and collaborators retain full access

Why: No further detail recorded for this rule.
Fix: —

LOWPrompt injectionprompt.credential_read · README.md:1651

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

When using Docker, you can pass the read-only mode as an environment variable:

Why: asks the agent to read credentials
Fix: —

LOWPrompt injectionprompt.credential_read · README.md:1664

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

Lockdown mode is a best-effort content filter intended to reduce the risk of prompt injection from untrusted repository content (issues, pull requests, comments, commits, etc.). It is **not** an autho

Why: asks the agent to read credentials
Fix: —

LOWPrompt injectionprompt.credential_read · docs/server-configuration.md:299

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

Lockdown mode is a best-effort content filter meant to reduce prompt-injection risk from untrusted repository content; it is not an authorization boundary. It does not restrict what the underlying cre

Why: asks the agent to read credentials
Fix: —

LOWPrompt injectionprompt.persistence · docs/installation-guides/install-claude.md:91

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

2. Add to your `PATH`

Why: instructs the agent to persist itself in the user's environment
Fix: —

Tools it exposes

None declared in source

No tools were found in the source, so we cannot say what this server exposes.

Install

Package version 1.0.0 · audited commit 8bd0df9

Read the findings first. The most severe is Obfuscation / stealth (medium) at pkg/github/__toolsnaps__/assign_copilot_to_issue.snap.

No connect command is recorded for this server yet. Follow the repository's own instructions, and read the findings above first.

Audit history

2026-09-19
!CAUTION C 74 / 100
Source changed, verdict held · 8bd0df9a61a0

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: CAUTION C](https://modelsatlas.com/mcp/github/github-15/badge.svg)](https://modelsatlas.com/mcp/github/github-15/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about GitHub MCP server

What is the GitHub MCP server?

GitHub's official MCP Server

Is GitHub safe to connect to an agent?

With care. The audit graded it C (74/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does GitHub need?

No credential environment variables were found in its source, so it appears to need none.

How does GitHub run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @github/mcp-server-ui at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (8bd0df9a61a0), read on 2026-09-19. The repository is watched and re-audited when it changes.

Sources

github/github-mcp-server on GitHub — the source we read, its licence, stars and activityObserved · 19 Sep 2026
ModelsAtlas trust audit — CAUTION verdict for commit 8bd0df9a61a0Observed · 19 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the GitHub MCP server?
GChatGPT CClaude PPerplexity
Is GitHub safe to connect to an agent?
GChatGPT CClaude PPerplexity
What credentials does GitHub need?
GChatGPT CClaude PPerplexity