Menu
Use when the user wants to connect to GitHub, search or read issues / PRs / code, create or update issues and PRs, inspect Actions runs, or review Dependabot / code-scanning alerts. The connector โ not security tradecraft.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | github |
| description | Use when the user wants to connect to GitHub, search or read issues / PRs / code, create or update issues and PRs, inspect Actions runs, or review Dependabot / code-scanning alerts. The connector โ not security tradecraft. |
Connector for GitHub via its official remote MCP server. The agent sees the enabled tool surface (~58 tools) once the server loads โ this skill covers what the tool specs don't: auth, read-only scoping, the issue-search DSL, and the non-obvious idioms. Security triage methodology โ dedup, severity, SLA, owner inference โ is deliberately out of scope; pair this with whichever triage capability your workflow uses.
Token sent as a Bearer header โ no OAuth. This is a GitHub-side limit: its
remote MCP server doesn't support Dynamic Client Registration and its OAuth web
flow needs a client_secret that can't ship in an installed tool, so OAuth is
reserved for GitHub's allowlisted first-party hosts (VS Code, Cursor, โฆ). For this
connector, a token is the path.
Already using the gh CLI? Reuse its session โ no new token.
gh auth token # copy the output into /secrets โ GITHUB_PAT
Quickest path for most developers. gh OAuth tokens can rotate/expire, so for a
long-lived / unattended setup mint a fine-grained PAT instead:
Contents, Issues, Pull requests, Metadata (Read), plus
Code scanning alerts + Dependabot alerts (Read) for security data.Issues, Pull requests, Contents (Write) only where needed.GITHUB_PAT in the secrets screen (/secrets or F7) or the web app.
Confirm with dn secret list. Don't paste tokens into chat.Two independent read-only controls, and you want both:
Write permissions can't mutate. This is the
one that holds even if the server config changes.GITHUB_READ_ONLY_MODE=true (secrets screen or launching
shell) and reload. The manifest binds it to the remote server's X-MCP-Readonly
header, and the server then refuses to register mutating tools at all (58 โ 38).
Unset by default, so writes stay governed by the PAT alone.The server-side flag is the useful backstop when the token is broader than the task โ the agent can't call what was never registered.
GitHub Enterprise. Enterprise Cloud with data residency changes the URL to
https://copilot-api.<subdomain>.ghe.com/mcp โ swap url: in capability.yaml.
Enterprise Server (self-hosted) doesn't support the remote server; use the local
Docker image (ghcr.io/github/github-mcp-server) with a stdio command: entry.
Ask before doing this โ the manifest changes aren't drive-by.
search_issues takes GitHub's structured query (keyword tokens + repo:, is:,
state:, label:, author:, assignee:, in:title, sort: โฆ) and covers
both issues and PRs โ qualify with is:issue / is:pr. Prefer it over
list_issues for anything more specific than state.
repo:owner/name is:issue is:open label:bug author:alice
Reference: https://docs.github.com/en/search-github/searching-on-github/searching-issues-and-pull-requests.
owner and repo.issue_read / issue_write are dispatcher tools: pick the method (get,
get_comments, get_sub_issues, get_labels for read; create, update for
write). Sub-issues are first-class via sub_issue_write.list_issue_types, get_label) rather than guessing them.security_events scope (or fine-grained Code scanning alerts: Read +
Dependabot alerts: Read): list_dependabot_alerts, get_dependabot_alert,
list_code_scanning_alerts, get_code_scanning_alert. These are not in the
server's default toolset โ the manifest requests them via X-MCP-Toolsets. If
they're missing from the surface, that header is why, not the token.default, actions, and the three
security toolsets (58 tools); all is 95. Trim or extend the X-MCP-Toolsets
header in capability.yaml to trade surface for context budget โ
https://github.com/github/github-mcp-server/blob/main/docs/remote-server.md.Pre-engagement reconnaissance workflow using HackerOne MCP tools to enumerate program scope, study prior disclosures, and identify high-value targets. Use when starting a new HackerOne program engagement, building an asset inventory, or planning target selection before active testing.
Pre-submission eligibility check for bug bounty findings. Catches ineligible patterns, AI/scanner false positives, and generates impact justification for borderline lows. Use before writing a report or when assessing whether a finding is worth reporting.
Static code analysis for DOM-based vulnerabilities in client-side JavaScript -- source/sink enumeration via grep and AST tools, data flow tracing, sanitization assessment, and framework-specific sink detection. Use when performing pre-commit reviews, auditing large codebases without dynamic execution, or triaging minified code for XSS issues.
Create custom jxscout analyzers (regex, derived, or script-based) and retrigger analysis. Use when the user wants to find specific code patterns across all project files, add new match kinds, or extend jxscout's static analysis capabilities.
Use when the user wants to connect to Jira, Confluence, or Compass โ search issues with JQL, read or create issues and pages, link content across products, or set up Atlassian auth. The connector โ not security tradecraft.
Use when the user wants to connect to Azure DevOps โ query Boards work items with WIQL, read PRs, inspect pipeline runs, create or update work items and wiki pages, or set up ADO auth. The connector โ not security tradecraft.