Developer · MCP Server

GitHub MCP: setup, permissions and security risks

The GitHub MCP server gives an agent repositories, issues, pull requests, and workflow runs. That is useful, and it is also a set of real capabilities pointed at a real system. Here is what it exposes, why it is worth governing, and the policy to put in front of it.

Exposure grade D

6 of 7 points, default setup. Last checked October 21, 2026.

Returns text written by people outside your team	Yes, +2
Can change things outside your machine	Yes, +1
Can do something hard to undo	Yes, +1
Can read local files or run code locally	No
Default credential is long-lived and broad	Yes, +1
Advisory or disclosure in the 12 months before the check	Yes, +1

0–1 points is A, 2–3 B, 4 C, 5–6 D, 7 F. The grade measures how much the default setup can reach, not the quality of the code. The hardening options below lower it.

Setup

Remote server hosted by GitHub (Claude Code, token in a header)

claude mcp add-json github '{"type":"http","url":"https://api.githubcopilot.com/mcp","headers":{"Authorization":"Bearer '"$GITHUB_PAT"'"}}'

Local server in Docker, read-only with lockdown mode

claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=$GITHUB_PAT -- \
  docker run -i --rm \
  -e GITHUB_PERSONAL_ACCESS_TOKEN -e GITHUB_READ_ONLY=1 -e GITHUB_LOCKDOWN_MODE=1 \
  ghcr.io/github/github-mcp-server

How it logs in

OAuth (the remote server in hosts that support it, such as VS Code, or the local server’s browser login) or a personal access token. GitHub’s README suggests the classic repo, read:packages and read:org scopes; repo alone covers every private repository the account can see. A fine-grained token limited to the repositories the agent needs is the narrower choice.

Tools that change things

create_pull_requestmerge_pull_requestissue_writeadd_issue_commentlabel_writeactions_run_triggercreate_gistprojects_write

Built-in hardening

--read-only skips every write tool, even ones named in --tools.
--toolsets limits which groups load. The default is context, repos, issues, pull_requests and users; actions, gists and the rest are off until you add them.
--lockdown-mode withholds public-repo content from authors without push access. GitHub calls it a best-effort content filter, not an authorization boundary.

Known advisories and incidents

What the server hands your agent

Read and write access to repositories: browsing code, opening and commenting on issues and pull requests, and in most configurations pushing branches and triggering workflow runs.

Why it is worth governing

Issue bodies, PR descriptions, and review comments are written by anyone who can reach the repository. An agent that reads them has read attacker-controlled text.
The same server that reads that text can usually also push a branch, comment publicly, or start a workflow, so read and act sit behind one connector.
Repository contents routinely include credentials in test fixtures, CI config, and commit history.

Tag what the tools actually do

Prismor tags every tool by behavior rather than by name, so rules survive a server adding tools you have never seen. A sensible starting map for GitHub:

Tool pattern	Tags	Why
mcp__github__issue	untrusted_content	issue and comment bodies are attacker-writable
mcp__github__pull	untrusted_content	PR descriptions and review threads are equally open
mcp__github__create_*	critical_action	creating an issue, PR, or comment is publicly visible
mcp__github__merge	critical_action	merging changes what ships
mcp__github__*_write	critical_action	issue_write, label_write and friends change shared state
mcp__github__actions_run_trigger	critical_action	starting a workflow runs code on your runners

Patterns are illustrative globs. Run prismor tags list to see how your installed tools actually resolve.

The policy

Rules read as a sentence: a tag, then or with another tag, and what to do about it. Note the mode - start by watching, not blocking.

settings:
  tool_tags:
    enabled: true
    mode: observe            # switch to enforce once the log looks right
    tags:
      "mcp__github__*issue*": [untrusted_content]
      "mcp__github__*pull*": [untrusted_content]
      "mcp__github__create_*": [critical_action]
      "mcp__github__*merge*": [critical_action]
      "mcp__github__*_write": [critical_action]
      "mcp__github__actions_run_trigger": [critical_action]
    rules:
      - "untrusted_content then critical_action -> block"
      - "untrusted_content with secrets_access -> warn"

Putting GitHub behind the gateway

You do not change the GitHub server or how it is configured. Move your existing mcpServers block behind the Prismor gateway and point your agent at Prismor instead:

prismor mcp-gateway install    # moves your .mcp.json servers behind the gateway
prismor mcp-gateway uninstall  # restores the original, backup kept

Your agent sees the same GitHub tools, namespaced as mcp__github__<tool>. Every call is evaluated against policy before it is forwarded, and every result is scanned as untrusted content before the model sees it.

Frequently asked questions

Is the GitHub MCP server safe to give an AI agent?

It is as safe as the credential behind it and the policy in front of it. The server itself is not the problem: the risk is that an agent can combine GitHub access with everything else in the session, with no record of what it did. Front it with a gateway that evaluates each call and logs the verdict.

Does Prismor replace the GitHub MCP server?

No. You keep running the same server, unchanged. Prismor aggregates it behind a single connector so your agent sees the same tools, namespaced as mcp__<server>__<tool>, with every call and every result passing through policy first.

Will this block work my team actually needs to do?

Not if you start in observe mode. Every call is recorded with the decision that would have applied, and nothing is blocked. You promote rules to enforce once the log shows the policy matches how your agents really work.

What about tool results, not just tool calls?

Results are scanned as untrusted content before the model sees them. A response carrying injected instructions or poisoned output is withheld and replaced with the reason, which matters most for servers that return text other people wrote.

One gateway for every MCP server

GitHub is one connector. The same policy covers the rest of them, plus the shell commands and file access your agents already have.

Install Prismor How MCP security works

Other developer servers

Chrome DevTools

GitLab FIFilesystem

Playwright All servers

GitHub is a trademark of its respective owner. Prismor is not affiliated with or endorsed by it. The GitHub MCP server is third-party software; Prismor governs it the same way it governs any MCP server, without modifying it.