// SCAN REPORT

GitHub

86 tools. 31 can modify or destroy data without limits.

2 destructive tools with no built-in limits. Policy required.

Last updated: 12 Jun 2026

31 can modify or destroy data

55 read-only

86 tools total

Official server · catalogue entry checked 12/06/2026 · full schemas captured for 84 of 86 tools

How to control GitHub ↓

TOOL MAP

What GitHub exposes to your agents

Read (55) Write / Execute (29) Destructive / Financial (2)

Running more than one server? Check your whole stack →

CONTEXT-WINDOW COST

What GitHub costs in tokens

14,406 tokens of tool definitions, loaded on every request

7.2% of a 200k context window

569 heaviest tool: actions_list

Full per-tool breakdown → Model it in the token calculator →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous GitHub tools

Destructive · High delete_file Deletion of files from a repository is a destructive operation that cannot be undone without access to version history or backups. Destructive · High projects_write The tool explicitly supports 'delete project items', which is an irreversible destructive operation. Execute · High actions_run_trigger While the tool includes destructive operations (deleting logs), its primary purpose is to trigger/execute GitHub Actions workflows. Execute · High assign_copilot_to_issue This tool triggers an external AI agent (GitHub Copilot) to autonomously work on a GitHub issue and potentially create pull requests with code changes.

31 of GitHub's 86 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control GitHub

PolicyLayer is an MCP gateway — it sits between your AI agents and GitHub, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "delete_file": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "add_comment_to_pending_review": {
    "limits": [
      {
        "counter": "add_comment_to_pending_review_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "actions_get": {
    "limits": [
      {
        "counter": "actions_get_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register GitHub — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON GITHUB →

Instant setup, no code required.

FULL CATALOGUE

All 86 GitHub tools

DESTRUCTIVE 2 tools

Destructive delete_file Delete a file from a GitHub repository Destructive projects_write Add, update, or delete project items, or create status updates in a GitHub Project.

EXECUTE 2 tools

Execute actions_run_trigger Trigger GitHub Actions workflow operations, including running, re-running, cancelling workflow runs, and delet Execute assign_copilot_to_issue Assign Copilot to a specific issue in a GitHub repository. This tool can help with the following outcomes: -

WRITE 27 tools

Write add_comment_to_pending_review Add review comment to the requester's latest pending pull request review. A pending review needs to already ex Write add_issue_comment Add a comment to a specific issue in a GitHub repository. Use this tool to add comments to pull requests as we Write add_reply_to_pull_request_comment Add a reply to an existing pull request comment. This creates a new comment that is linked as a reply to the s Write create_branch Create a new branch in a GitHub repository Write create_gist Create a new gist Write create_or_update_file Create or update a single file in a GitHub repository. If updating, you should provide the SHA of the file yo Write create_pull_request Create a new pull request in a GitHub repository. Write create_pull_request_with_copilot Delegate a task to GitHub Copilot coding agent to perform in the background. The agent will create a pull requ Write create_repository Create a new GitHub repository in your account or specified organization Write dismiss_notification Dismiss a notification by marking it as read or done Write fork_repository Fork a GitHub repository to your account or specified organization Write issue_write Create a new or update an existing issue in a GitHub repository. Write label_write Perform write operations on repository labels. To set labels on issues, use the 'update_issue' tool. Write manage_notification_subscription Manage a notification subscription: ignore, watch, or delete a notification thread subscription. Write manage_repository_notification_subscription Manage a repository notification subscription: ignore, watch, or delete repository notifications subscription Write mark_all_notifications_read Mark all notifications as read Write merge_pull_request Merge a pull request in a GitHub repository. Write pull_request_review_write Create and/or submit, delete review of a pull request. Available methods: - create: Create a new review of a Write push_files Push multiple files to a GitHub repository in a single commit Write request_copilot_review Request a GitHub Copilot code review for a pull request. Use this for automated feedback on pull requests, usu Write star_repository Star a GitHub repository Write sub_issue_write Add a sub-issue to a parent issue in a GitHub repository. Write triage_issue Triage an issue by capturing a focused triage rationale and optionally applying metadata (labels, issue type, Write unstar_repository Unstar a GitHub repository Write update_gist Update an existing gist Write update_pull_request Update an existing pull request in a GitHub repository. Write update_pull_request_branch Update the branch of a pull request with the latest changes from the base branch.

READ 55 tools

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about GitHub

Can an AI agent delete data through the GitHub MCP server? +

Yes. The GitHub server exposes 2 destructive tools including delete_file, projects_write. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through GitHub? +

The GitHub server has 27 write tools including add_comment_to_pending_review, add_issue_comment, add_reply_to_pull_request_comment. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach GitHub.

How many tools does the GitHub MCP server expose? +

86 tools across 4 categories: Destructive, Execute, Read, Write. 55 are read-only. 31 can modify, create, or delete data.

How do I enforce a policy on GitHub? +

Register the GitHub MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every GitHub tool call.

Deterministic rules across all 86 GitHub tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON GITHUB →

Instant setup, no code required.

86 GitHub tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from GitHub's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →