github/github-mcp-server

At a glance

What to fix first

9 issues, most severe first. Each one points to the exact code, with the recommended fix and a prompt you can paste into your coding agent.

1. 1HighDependency Risk & Supply Chain
   Repository-wide · ATR-C0007
   Trivy identified five CVEs affecting golang.org/x/net v0.59.0, but the only direct imports found in the codebase are the html and httpguts packages, not the HTTP/2 implementation; the advisories establish vulnerable dependency presence rather than a demonstrated HTTP/2 exploitation path reachable from this code. A more concrete supply-chain risk is the release workflow (.github/workflows/registry-releaser.yml), which clones and builds an unversioned/unpinned publisher repository and executes it with OIDC publishing authority, meaning any compromise of that external source could execute arbitrary code with release-publishing credentials. Mutable version tags on actions/cache and actions/setup-node in build-ui/action.yml are a related integrity weakness; the absence of a Dependabot cooldown is a hardening gap rather than demonstrated compromise.

   Show more
   go.mod:23–24 ↗

   golang.org/x/net v0.59.0
   golang.org/x/oauth2 v0.37.0

   Show 2 more locations

   go.mod:1–3 ↗

   module github.com/github/github-mcp-server/v2
   
   go 1.27.3

   .github/actions/build-ui/action.yml:9–24 ↗

       - name: Cache UI artifacts
         id: cache-ui
         uses: actions/cache@v6
         with:
           path: |
             pkg/github/ui_dist/get-me.html
             pkg/github/ui_dist/issue-write.html
             pkg/github/ui_dist/pr-write.html
             pkg/github/ui_dist/pr-edit.html
           key: ui-dist-v3-${{ hashFiles(...) }}
           enableCrossOsArchive: true
   
       - name: Set up Node.js
         if: steps.cache-ui.outputs.cache-hit != 'true'
   …

   +6 more locations in the finding JSON

   Recommended fix

   Bump golang.org/x/net to >=0.60.0; pin actions/cache and actions/setup-node to immutable commit SHAs; add dependabot cooldown entries for gomod/npm/docker ecosystems; and pin the registry-releaser workflow's cloned publisher source to a fixed, verified commit or tag rather than building and executing it unpinned with OIDC publish authority.

   Create fix promptCopy finding JSON
2. 2HighTool Output Sanitization & Injection Containment
   Repository-wide · ATR-C0013
   Third-party/user-authored content returned by tools (issue bodies, PR bodies, comments, discussions, etc.) is passed through sanitize.Content before being placed into tool results, but sanitize.Content only filters invisible/zero-width/bidi Unicode characters -- it does not strip HTML or code-fence metadata; only sanitize.PlainText, used for title-type fields, performs that additional filtering. An all-ASCII issue body containing a fabricated role/instruction marker passes through sanitize.Content unchanged. The IFC untrusted-content labeling mechanism provides a real mitigation but is feature-gated and is omitted when a visibility lookup fails, so it does not provide a mandatory, universally-applied containment policy. The JSON structural boundary around tool results is a real but partial mitigation that does not, by itself, neutralize crafted instruction-like text from being included verbatim in model-visible output, though this does not demonstrate that a downstream model actually executes an injected instruction.

   Show more
   pkg/github/minimal_types.go:814–819 ↗

   func convertToMinimalIssue(issue *github.Issue) MinimalIssue {
   	m := MinimalIssue{
   		Number:            issue.GetNumber(),
   		Title:             sanitize.PlainText(issue.GetTitle()),
   		Body:              sanitize.Content(issue.GetBody()),
   		State:             issue.GetState(),

   Show 2 more locations

   pkg/sanitize/sanitize.go:46–48 ↗

   func Content(input string) string {
   	return FilterInvisibleCharacters(input)
   }

   pkg/sanitize/sanitize.go:174–183 ↗

   		}
   	}
   	return input
   }
   
   // filterInvisibleFrom resumes FilterInvisibleCharacters at start, the first byte
   // that could need filtering. It buffers output only once a rune actually
   // changes, so input that turns out to be clean is still returned as-is.
   func filterInvisibleFrom(input string, start int) string {
   	var (

   +2 more locations in the finding JSON

   Recommended fix

   Apply instruction/role-marker-aware filtering, not only invisible-character stripping, to all third-party content routed through sanitize.Content, and make IFC untrusted-content labeling mandatory (fail-closed) rather than omitted on visibility-lookup failure, so externally authored text cannot masquerade as system/tool-level instructions.

   Create fix promptCopy finding JSON
3. 3HighBinding to 0.0.0.0 Without Auth/TLS
   mcp-server (MCP server) · ATR-M0004
   The HTTP server binds to all interfaces by default when --listen-host is unset (resolveListenAddress returns ':8082'), and the default self-hosted deployment serves this listener via plaintext ListenAndServe with no TLS termination enforced in-process or required by configuration. Every request is gated by mandatory bearer-token authentication (ExtractUserToken middleware returns 401 with a WWW-Authenticate challenge when the Authorization header is missing), so an unauthenticated caller cannot invoke any tool merely by reaching the port. However, this check does not protect the bearer credential itself in transit: a caller connecting to this default, all-interface, non-TLS listener from a remote network position can have their Authorization header intercepted on-path, since no TLS or loopback restriction is enforced by default for the self-hosted binary. The documented hosted endpoint (https://api.githubcopilot.com/mcp/) is a separate, TLS-terminated deployment and does not protect operators running the default self-hosted configuration directly.

   Show more
   pkg/http/server.go:276–281 ↗

   func resolveListenAddress(host string, port int) string {
   	if host == "" {
   		return fmt.Sprintf(":%d", port)
   	}
   	return net.JoinHostPort(host, strconv.Itoa(port))
   }

   Show 2 more locations

   pkg/http/server.go:225–230 ↗

   	addr := resolveListenAddress(cfg.ListenHost, cfg.Port)
   	httpSvr := http.Server{
   		Addr:              addr,
   		Handler:           r,
   		ReadHeaderTimeout: 60 * time.Second,
   	}

   pkg/http/server.go:247–250 ↗

   	logger.Info("HTTP server listening", "addr", addr)
   	if err := httpSvr.ListenAndServe(); err != nil && err != http.ErrServerClosed {
   		return fmt.Errorf("HTTP server error: %w", err)
   	}

   +2 more locations in the finding JSON

   Recommended fix

   Default --listen-host to 127.0.0.1 so the server does not bind to all interfaces without an explicit operator opt-in, and/or require (not merely document) that the process sit behind a TLS-terminating reverse proxy before accepting bearer-token-bearing requests; refuse to start in all-interface mode without TLS unless explicitly overridden.

   Create fix promptCopy finding JSON
4. 4HighTransport Security: TLS Everywhere (Remote)
   mcp-server (MCP server) · ATR-M0009
   RunHTTPServer binds to all interfaces by default via an address derived from an unset --listen-host and serves the connection via plaintext ListenAndServe -- there is no TLS/loopback requirement enforced, and no TLS-terminating proxy is required by the executable itself. Outbound client traffic to the GitHub API does enforce HTTPS, but that outbound enforcement does not secure the inbound MCP transport that this rule evaluates. The documented hosted endpoint (https://api.githubcopilot.com/mcp/) is a separately TLS-terminated deployment and does not establish TLS protection for this executable's own default, self-hosted startup path; a caller connecting directly to the default HTTP listener transmits its bearer Authorization header in cleartext, which an on-path attacker could intercept.

   Show more
   cmd/github-mcp-server/main.go:229–232 ↗

   			}
   
   			return ghhttp.RunHTTPServer(httpConfig)
   		},

   Show 2 more locations

   pkg/http/server.go:225–230 ↗

   	addr := resolveListenAddress(cfg.ListenHost, cfg.Port)
   	httpSvr := http.Server{
   		Addr:              addr,
   		Handler:           r,
   		ReadHeaderTimeout: 60 * time.Second,
   	}

   pkg/http/server.go:247–250 ↗

   	logger.Info("HTTP server listening", "addr", addr)
   	if err := httpSvr.ListenAndServe(); err != nil && err != http.ErrServerClosed {
   		return fmt.Errorf("HTTP server error: %w", err)
   	}

   +2 more locations in the finding JSON

   Recommended fix

   Require TLS for the HTTP listener by default (or refuse to serve bearer-token-protected routes over plaintext without an explicit operator override), and/or make a TLS-terminating reverse proxy mandatory rather than merely documented for any non-loopback binding.

   Create fix promptCopy finding JSON
5. 5MediumDoS Protections: Timeouts, Concurrency, Streaming Limits
   Repository-wide · ATR-C0004
   The HTTP server sets ReadHeaderTimeout (60s), which bounds only the time to receive request headers. The request body is read via io.ReadAll in the handler path with no accompanying read deadline or per-request timeout, so a client that completes headers and then sends a body slowly, staying under the configured max-body-size, can hold the connection and its associated goroutine open indefinitely. Neither the max-body-size limit nor the batch-operation semaphores bound this slow-body read path, and no request-level or body-read deadline is configured distinct from the server's long-lived streaming response policy.

   Show more
   pkg/http/server.go:213–230 ↗

   	r := newHTTPRouter(
   		func(r chi.Router) {
   			// Register Middleware First, needs to be before route registration
   			handler.RegisterMiddleware(r)
   			// Register MCP server routes
   			handler.RegisterRoutes(r)
   		},
   		oauthHandler.RegisterRoutes,
   	)
   	logger.Info("MCP endpoints registered", "baseURL", cfg.BaseURL)
   	logger.Info("OAuth protected resource endpoints registered", "baseURL", cfg.BaseURL)
   
   	addr := resolveListenAddress(cfg.ListenHost, cfg.Port)
   	httpSvr := http.Server{
   …

   Show 2 more locations

   pkg/http/handler.go:138–146 ↗

   func (h *Handler) RegisterMiddleware(r chi.Router) {
   	r.Use(
   		// Must run first: bounds the body before anything downstream reads it.
   		middleware.WithMaxBodySize(h.maxRequestBodyBytes()),
   		middleware.ExtractUserToken(h.oauthCfg),
   		middleware.WithRequestConfig,
   		middleware.WithMCPParse(),
   		middleware.WithPATScopes(h.logger, h.scopeFetcher),
   	)

   pkg/http/middleware/mcp_parse.go:54–66 ↗

   			// Only parse POST requests (MCP uses JSON-RPC over POST)
   			if r.Method != http.MethodPost {
   				next.ServeHTTP(w, r)
   				return
   			}
   
   			// Read the request body
   			body, err := io.ReadAll(r.Body)
   			if err != nil {
   				if isMaxBytesError(err) {
   					writeRequestTooLarge(w)
   					return
   				}

   +1 more location in the finding JSON

   Recommended fix

   Add an explicit read deadline (e.g. a timeout handler, SetReadDeadline, or a per-request context deadline applied before io.ReadAll) for request bodies, separate from the timeout used for long-lived streaming responses, so slow-body connections are closed after a bounded interval.

   Create fix promptCopy finding JSON

What’s inside

BlueRock found 1 component in this repository. Each is checked against the rules for its type.

func (m *Manager) beginPKCE(prompter Prompter) (*flowPlan, error) {
	state, err := randomState()
	...
	verifier := oauth2.GenerateVerifier()
	...
	authURL := oc.AuthCodeURL(state, oauth2.S256ChallengeOption(verifier))
	run := func(ctx context.Context) (*oauth2.Token, error) {
		code, err := cs.wait(ctx)
		...
		tok, err := oc.Exchange(ctx, code, oauth2.VerifierOption(verifier))
		...

		if q.Get("state") != expectedState {
			cs.report(callbackResult{err: fmt.Errorf("state mismatch (possible CSRF)")})
			renderError(w, "state mismatch")
			return
		}

func (h *AuthHandler) metadataHandler() http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		...
		metadata := &oauthex.ProtectedResourceMetadata{
			Resource:               resourceURL,
			AuthorizationServers:   []string{authorizationServerURL},
			...

func (h *Handler) RegisterMiddleware(r chi.Router) {
	r.Use(
		middleware.WithMaxBodySize(h.maxRequestBodyBytes()),
		middleware.ExtractUserToken(h.oauthCfg),
		middleware.WithRequestConfig,
		middleware.WithMCPParse(),
		middleware.WithPATScopes(h.logger, h.scopeFetcher),
	)
	if h.config.ScopeChallenge {
		r.Use(middleware.WithScopeChallenge(h.oauthCfg, h.scopeFetcher))
	}
}

			tokenType, token, err := utils.ParseAuthorizationHeader(r)
			if err != nil {
				if errors.Is(err, utils.ErrMissingAuthorizationHeader) {
					sendAuthChallenge(w, r, oauthCfg)
					return
				}
				http.Error(w, err.Error(), http.StatusBadRequest)
				return
			}

func AllTools(t translations.TranslationHelperFunc, opts ...ToolOption) []inventory.ServerTool {
	cfg := newToolConfig(opts)
	return withCSVOutput([]inventory.ServerTool{
		// Context tools
		GetMe(t),
		GetTeams(t),
		GetTeamMembers(t),

		// Repository tools
		SearchRepositories(t),
		GetFileContents(t),
		...

name: MCP Server Diff

on:
  pull_request:
  push:
    branches: [main]
    tags: ['v*']

permissions:
  contents: read

jobs:
  mcp-diff:
    runs-on: ubuntu-latest
…

func RequireAll(required ...Scope) inventory.ScopeAccess {
	required = append([]Scope(nil), required...)
	requiredScopes := scopeStrings(required)
	return inventory.ScopeAccess{
		Scopes: append([]string(nil), requiredScopes...),
		Visible: func(activeScopes []string) bool {
			return HasAll(activeScopes, required...)
		},
		Challenge: func(_ map[string]any, activeScopes []string) []string {
			if HasAll(activeScopes, required...) {
				return nil
			}
			return append([]string(nil), requiredScopes...)
		},
…

func PATScopeFilter(b *inventory.Builder, r *http.Request, fetcher scopes.FetcherInterface) *inventory.Builder {
	ctx := r.Context()
	tokenInfo, ok := ghcontext.GetTokenInfo(ctx)
	if !ok || tokenInfo == nil {
		return b
	}
	if tokenInfo.TokenType == utils.TokenTypePersonalAccessToken {
		existingScopes, ok := ghcontext.GetTokenScopes(ctx)
		if ok {
			return b.WithFilter(github.CreateToolScopeFilter(existingScopes))
		}
		...

func SetCorsHeaders(h http.Handler) http.Handler {
	fixedAllowHeaders := strings.Join(corsAllowedRequestHeaders, ", ")
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Access-Control-Allow-Origin", "*")
		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS")
		w.Header().Set("Access-Control-Max-Age", "86400")
		w.Header().Add("Access-Control-Expose-Headers", "Mcp-Session-Id, WWW-Authenticate")
		w.Header().Set("Access-Control-Allow-Headers", fixedAllowHeaders)
		...

assert.Empty(t, rr.Header().Get("Access-Control-Allow-Credentials"))

func AllTools(t translations.TranslationHelperFunc, opts ...ToolOption) []inventory.ServerTool {
	cfg := newToolConfig(opts)
		SearchRepositories(t), GetFileContents(t), ListCommits(t), SearchCode(t), ...

func Sanitize(input string) string {
	filtered := FilterCodeFenceMetadata(FilterInvisibleCharacters(input))
	normalized := FilterHTMLTags(filtered)
	if normalized == filtered {
		return normalized
	}
	return FilterCodeFenceMetadata(FilterInvisibleCharacters(normalized))
}

func (h *AuthHandler) metadataHandler() http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		...
		metadata := &oauthex.ProtectedResourceMetadata{
			Resource:               resourceURL,
			AuthorizationServers:   []string{authorizationServerURL},
			ResourceName:           "GitHub MCP Server",
			...
		auth.ProtectedResourceMetadataHandler(metadata).ServeHTTP(w, r)
	})
}

Repository-wide rules

Checked once for the whole repository: dependencies, secrets, inputs, networking, CI and more. 6 of 15 flagged.

func openBrowser(url string) error {
	var cmd *exec.Cmd
	switch runtime.GOOS {
	case "linux":
		if os.Getenv("DISPLAY") == "" && os.Getenv("WAYLAND_DISPLAY") == "" {
			return errNoDisplay
		}
		cmd = exec.Command("xdg-open", url)
	case "darwin":
		cmd = exec.Command("open", url)
	case "windows":
		cmd = exec.Command("rundll32", "url.dll,FileProtocolHandler", url)

func executeServerCommand(cmdStr, jsonRequest string) (string, error) {
	cmdParts := strings.Fields(cmdStr)
	if len(cmdParts) == 0 {
		return "", fmt.Errorf("empty command")
	}

	cmd := exec.Command(cmdParts[0], cmdParts[1:]...) //nolint:gosec //mcpcurl is a test command that needs to execute arbitrary shell commands

# GitHub MCP Server

The GitHub MCP Server connects AI tools directly to GitHub's platform. This gives AI agents, assistants, and chatbots the ability to read repositories and code files, manage issues and PRs, analyze code, and automate workflows. All through natural language interactions.

### Use Cases

- Repository Management: Browse and query code, search files, analyze commits, and understand project structure across any repository you have access to.
- Issue & PR Automation: Create, update, and manage issues and pull requests. Let AI help triage bugs, review code changes, and maintain project boards.
- CI/CD & Workflow Intelligence: Monitor GitHub Actions workflow runs, analyze build failures, manage releases, and get insights into your development pipeline.
- Code Analysis: Examine security findings, review Dependabot alerts, understand code patterns, and get comprehensive insights into your codebase.
- Team Collaboration: Access discussions, manage notifications, analyze team activity, and streamline processes for your team.

func downloadLogContent(ctx context.Context, logURL string, tailLines int, maxLines int) (string, int, *http.Response, error) {
	prof := profiler.New(nil, profiler.IsProfilingEnabled())
	finish := prof.Start(ctx, "log_buffer_processing")

	httpResp, err := http.Get(logURL) //nolint:gosec
	if err != nil {
		return "", 0, httpResp, fmt.Errorf("failed to download logs: %w", err)
	}
	defer func() { _ = httpResp.Body.Close() }()

func (c *Client) refURL(owner, repo, ref, path string) (string, error) {
	if ref == "" {
		ref = "HEAD"
	}
	if err := rejectPathTraversal(owner, repo, ref, path); err != nil {
		return "", err
	}
	return c.url.JoinPath(owner, repo, ref, path).String(), nil
}

// OptionalParam is a helper function that can be used to fetch a requested parameter from the request.
func OptionalParam[T any](args map[string]any, p string) (T, error) {

if err := json.Unmarshal(encoded, schema); err != nil {
    return nil, fmt.Errorf(...)
}

func rejectSegment(segment string) error {
	if segment == "" {
		return nil
	}
	if segment == ".." {
		return errPathTraversal
	}
	decoded, err := url.PathUnescape(segment)
	if err != nil || decoded == segment {
		return nil
	}
	for subsegment := range strings.SplitSeq(decoded, "/") {
		if err := rejectSegment(subsegment); err != nil {
			return err
…

on:
  push:
    tags: ["v*"]  # Triggers on version tags like v1.0.0
  workflow_dispatch:  # Allow manual triggering
...
      - name: Wait for Docker image
        run: |
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            TAG="${{ github.ref_name }}"
          else

on:
  issues:
    types: [reopened, opened]
jobs:
  label_issues:
    permissions:
      issues: write
    steps:
      - name: Add AI review label to issue
        run: gh issue edit "$NUMBER" --add-label "$LABELS"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          NUMBER: ${{ github.event.issue.number }}
…

      - name: Wait for Docker image
        run: |
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            TAG="${{ github.ref_name }}"
          else
            TAG=$(git tag --sort=-version:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n1)
          fi
          IMAGE="ghcr.io/github/github-mcp-server:$TAG"

func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	inv, err := h.inventoryFactoryFunc(r)
	if err != nil {
		if errors.Is(err, inventory.ErrUnknownTools) {
			w.WriteHeader(http.StatusBadRequest)
			if _, writeErr := w.Write([]byte(err.Error())); writeErr != nil {
				h.logger.Error("failed to write response", "error", writeErr)
			}
			return
		}

// ErrUnknownTools is returned when tools specified via WithTools() are not recognized.
ErrUnknownTools = errors.New("unknown tools specified in WithTools")