// SCAN REPORT

GitHub

245 tools. 102 can modify or destroy data without limits.

5 destructive tools with no built-in limits. Policy required.

Last updated:

102 can modify or destroy data
143 read-only
245 tools total

Community server · catalogue entry checked 06/06/2026

How to control GitHub ↓

TOOL MAP

What GitHub exposes to your agents

Read (143) Write / Execute (55) Destructive / Financial (5)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS
Critical Risk

The most dangerous GitHub tools

Destructive · High delete_file This tool directly deletes files from a repository, which is an irreversible operation. Destructive · High force This tool forcibly removes a git worktree regardless of its state, potentially causing permanent loss of uncommitted work or locked resources. Destructive · Critical git_reset git reset --hard is irreversible and can permanently destroy uncommitted changes and move branch pointers, potentially losing work across a repository. Destructive · High git_worktree_remove Removing a git worktree is a destructive operation that eliminates a working tree associated with a repository.

102 of GitHub's 245 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control GitHub

PolicyLayer is an MCP gateway — it sits between your AI agents and GitHub, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations
{
  "delete_file": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
{
  "add_comment_to_pending_review": {
    "limits": [
      {
        "counter": "add_comment_to_pending_review_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
{
  "actions_get": {
    "limits": [
      {
        "counter": "actions_get_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

  1. Create a free account and register GitHub — nothing to install.
  2. Add these rules — paste them, or build them visually. Tune the limits to your setup.
  3. Point your MCP client (Claude, Cursor, anything) at your gateway URL.
ENFORCE POLICY ON GITHUB →

Instant setup, no code required.

FULL CATALOGUE

All 245 GitHub tools

DESTRUCTIVE 5 tools
Destructive delete_file Delete file Destructive force Force removal even if worktree is dirty or locked (optional, default: false) (boolean, optional) Destructive git_reset Git reset Destructive git_worktree_prune Git worktree prune Destructive git_worktree_remove Git worktree remove
EXECUTE 7 tools
Execute actions_run_trigger Trigger GitHub Actions workflow actions Execute detach Create a detached HEAD worktree (optional, default: false) (boolean, optional) Execute git_checkout Git checkout Execute git_pull Git pull Execute git_push Git push Execute git_worktree_add Git worktree add Execute git_worktree_lock Git worktree lock
WRITE 48 tools
Write add_comment_to_pending_review Add review comment to the requester's latest pending pull request review Write add_issue_comment Add comment to issue Write add_reply_to_pull_request_comment Add reply to pull request comment Write assign_copilot_to_issue Assign Copilot to issue Write assignees Usernames to assign to this issue (string[], optional) Write commit_message Extra detail for merge commit (string, optional) Write create_branch Create branch Write create_gist Create Gist Write create_or_update_file Create or update file Write create_pull_request Open new pull request Write create_repository Create repository Write dismiss_notification Dismiss notification Write draft Mark pull request as draft (true) or ready for review (false) (boolean, optional) Write duplicate_of Issue number that this issue is a duplicate of. Only used when state_reason is 'duplicate'. (number, optional) Write filename Filename to update or create (string, required) Write files Array of file objects to push, each object with path (string) and content (string) (object[], required) Write fork_repository Fork repository Write git_add Git add Write git_apply_patch_file Git apply patch file Write git_apply_patch_string Git apply patch string Write git_commit Git commit Write git_create_branch Git create branch Write git_init Git init Write git_worktree_unlock Git worktree unlock Write issue_comment_write Update or delete issue comment Write issue_write Create or update issue. Write label_write Write operations on repository labels. Write maintainer_can_modify Allow maintainer edits (boolean, optional) Write manage_notification_subscription Manage notification subscription Write manage_repository_notification_subscription Manage repository notification subscription Write mark_all_notifications_read Mark all notifications as read Write merge_method Merge method (string, optional) Write merge_pull_request Merge pull request Write new_branch Create a new branch with this name in the worktree (optional) (string, optional) Write patch_file Path to the patch file (string, required) Write patch_string Patch string to apply (string, required) Write projects_write Modify GitHub Project items Write pull_request_comment_write Update or delete pull request review comment Write pull_request_review_write Write operations (create, submit, delete) on pull request reviews. Write push_files Push files to repository Write replace_parent When true, replaces the sub-issue's current parent issue. Use with 'add' method only. (boolean, optional) Write request_copilot_review Request Copilot review Write star_repository Star repository Write sub_issue_write Change sub-issue Write unstar_repository Unstar repository Write update_gist Update Gist Write update_pull_request Edit pull request Write update_pull_request_branch Update pull request branch
READ 143 tools
Read actions_get Get details of GitHub Actions resources (workflows, workflow runs, jobs, and artifacts) Read actions_list List GitHub Actions workflows in a repository Read affects Filter advisories by affected package or version (e.g. "package1,package2@1.0.0"). (string, optional) Read after Forward pagination cursor from previous pageInfo.nextCursor. (string, optional) Read after_id The ID of the sub-issue to be prioritized after (either after_id OR before_id should be specified) (number, op Read alertNumber The number of the alert. (number, required) Read author Author username or email address to filter commits by (string, optional) Read before Backward pagination cursor from previous pageInfo.prevCursor (rare). (string, optional) Read category Optional filter by discussion category ID. If provided, only discussions with this category are listed. (strin Read commitish Branch name, tag, or commit SHA to checkout in the new worktree (optional) (string, optional) Read content Content of the file (string, required) Read custom_instructions Optional custom instructions to guide the agent beyond the issue body. Use this to provide additional context, Read cveId Filter by CVE ID. (string, optional) Read cwes Filter by Common Weakness Enumeration IDs (e.g. ["79", "284", "22"]). (string[], optional) Read discussionNumber Discussion Number (number, required) Read dry_run Show what would be pruned without actually pruning (optional, default: false) (boolean, optional) Read ecosystem Filter by package ecosystem. (string, optional) Read event Review action to perform. (string, optional) Read expectedHeadSha The expected SHA of the pull request's HEAD ref (string, optional) Read failed_only When true, gets logs for all failed jobs in the workflow run specified by run_id. Requires run_id to be provid Read field_id The field's ID. Required for 'get_project_field' method. (number, optional) Read fields Field IDs to include when listing project items (e.g. ["102589", "985201"]). CRITICAL: Always provide to get f Read filter Filter notifications to, use default unless specified. Read notifications are ones that have already been ackn Read from_branch Source branch (defaults to repo default) (string, optional) Read get Get details of a specific pull request. Read get_code_scanning_alert Get code scanning alert Read get_comments Get comments on a pull request. Use this if user doesn't specifically want review comments. Use with paginatio Read get_commit Get commit details Read get_dependabot_alert Get dependabot alert Read get_diff Get the diff of a pull request. Read get_discussion Get discussion Read get_discussion_comments Get discussion comments Read get_file_contents Get file or directory contents Read get_files Get the list of files changed in a pull request. Use with pagination parameters to control the number of resul Read get_gist Get Gist Content Read get_global_security_advisory Get a global security advisory Read get_job_logs Get GitHub Actions workflow job logs Read get_label Get a specific label from a repository. Read get_labels Get labels assigned to the issue. Read get_latest_release Get latest release Read get_me Get my user profile Read get_notification_details Get notification details Read get_release_by_tag Get a release by tag name Read get_repository_tree Get repository tree Read get_review_comments Get review threads on a pull request. Each thread contains logically grouped review comments made on the same Read get_reviews Get the reviews on a pull request. When asked for review comments, use get_review_comments method. Read get_secret_scanning_alert Get secret scanning alert Read get_status Get status of a head commit in a pull request. This reflects status of builds and checks. Read get_sub_issues Get sub-issues of the issue. Read get_tag Get tag details Read get_team_members Get team members Read get_teams Get teams Read ghsaId Filter by GitHub Security Advisory ID (format: GHSA-xxxx-xxxx-xxxx). (string, optional) Read git_diff Git diff Read git_diff_staged Git diff staged Read git_diff_unstaged Git diff unstaged Read git_list_repositories Git list repositories Read git_log Git log Read git_show Git show Read git_status Git status Read git_worktree_list Git worktree list Read head Filter by head user/org and branch (string, optional) Read include_diff Whether to include file diffs and stats in the response. Default is true. (boolean, optional) Read issue_read Get issue details Read isWithdrawn Whether to only return withdrawn advisories. (boolean, optional) Read item_id The project item ID. Required for 'update_project_item' and 'delete_project_item' methods. (number, optional) Read item_owner The owner (user or organization) of the repository containing the issue or pull request. Required for 'add_pro Read item_repo The name of the repository containing the issue or pull request. Required for 'add_project_item' method. (stri Read labels Filter by labels (string[], optional) Read lastReadAt Describes the last point that notifications were checked (optional). Default: Now (string, optional) Read line The line of the blob in the pull request diff that the comment applies to. For multi-line comments, the last l Read list_branches List branches Read list_code_scanning_alerts List code scanning alerts Read list_commits List commits Read list_dependabot_alerts List dependabot alerts Read list_discussion_categories List discussion categories Read list_discussions List discussions Read list_gists List Gists Read list_global_security_advisories List global security advisories Read list_issue_types List available issue types Read list_issues List issues Read list_label List labels from a repository Read list_notifications List notifications Read list_org_repository_security_advisories List org repository security advisories Read list_pull_requests List pull requests Read list_releases List releases Read list_repository_security_advisories List repository security advisories Read list_secret_scanning_alerts List secret scanning alerts Read list_starred_repositories List starred repositories Read list_tags List tags Read max_count Maximum number of commits to show (default: 10) (number, optional) Read milestone Milestone number (number, optional) Read minimal_output Return minimal repository information (default: true). When false, returns full GitHub API repository objects. Read modified Filter by publish or update date or date range (ISO 8601 date or range). (string, optional) Read notificationID The ID of the notification thread. (string, required) Read order Sort order (string, optional) Read orderBy Order issues by field. If provided, the 'direction' also needs to be provided. (string, optional) Read org The organization login. (string, required) Read organization Organization to fork to (string, optional) Read owner Repository owner (string, required) Read page Page number for pagination (min 1) (number, optional) Read path_filter Optional path prefix to filter the tree results (e.g., 'src/' to only show files in the src directory) (string Read per_page Results per page (max 50) (number, optional) Read project_number The project's number. (number, required) Read projects_get Get details of GitHub Projects resources Read projects_list List GitHub Projects resources Read public Whether the gist is public (boolean, optional) Read published Filter by publish date or date range (ISO 8601 date or range). (string, optional) Read pull_request_number The pull request number (use when item_type is 'pull_request' for 'add_project_item' method). Provide either i Read pull_request_read Get details for a single pull request Read pullNumber Pull request number (number, required) Read query User search query. Examples: 'john smith', 'location:seattle', 'followers:>100'. Search is automatically scope Read recursive Setting this parameter to true returns the objects or subtrees referenced by the tree. Default is false (boole Read ref Accepts optional git refs such as refs/tags/{tag}, refs/heads/{branch} or refs/pull/{pr_number}/head (string, Read repo Repository name (string, required) Read repo_path Path to Git repository (optional if default repository is configured) (string, optional) Read resolution Filter by resolution (string, optional) Read resource_id The unique identifier of the resource. This will vary based on the "method" provided, so ensure you provide th Read return_content Returns actual log content instead of URLs (boolean, optional) Read revision The revision (commit hash, branch name, tag) to show (string, required) Read search_code Search code Read search_issues Search issues Read search_orgs Search organizations Read search_pull_requests Search pull requests Read search_repositories Search repositories Read search_users Search users Read secret_type A comma-separated list of secret types to return. All default secret patterns are returned. To return generic Read severity Filter by severity. (string, optional) Read sha Commit SHA, branch or tag name to list commits of. If not provided, uses the default branch of the repository. Read since Only show notifications updated after the given time (ISO 8601 format) (string, optional) Read sort Sort users by number of followers or repositories, or when the person joined GitHub. (string, optional) Read state Filter by advisory state. (string, optional) Read status_update_id The node ID of the project status update. Required for 'get_project_status_update' method. (string, optional) Read tail_lines Number of lines to return from the end of the log (number, optional) Read target Target branch or commit to compare with (string, required) Read team_slug Team slug (string, required) Read tool_name The name of the tool used for code scanning. (string, optional) Read tree_sha The SHA1 value or ref (branch or tag) name of the tree. Defaults to the repository's default branch (string, o Read updated Filter by update date or date range (ISO 8601 date or range). (string, optional) Read user Username to get teams for. If not provided, uses the authenticated user. (string, optional) Read username Username to list starred repositories for. Defaults to the authenticated user. (string, optional) Read workflow_jobs_filter Filters for workflow jobs. ONLY used when method is 'list_workflow_jobs' (object, optional) Read workflow_runs_filter Filters for workflow runs. ONLY used when method is 'list_workflow_runs' (object, optional)
OTHER 42 tools
Other autoInit Initialize with README (boolean, optional) Other base New base branch name (string, optional) Other base_branch Starting point for the new branch (optional) (string, optional) Other base_ref Git reference (e.g., branch) that the agent will start its work from. If not specified, defaults to the reposi Other before_id The ID of the sub-issue to be prioritized before (either after_id OR before_id should be specified) (number, o Other branch Branch to push to (string, required) Other branch_name Name of the new branch (string, required) Other color Label color as 6-character hex code without '' prefix (e.g., 'f29513'). Required for 'create', optional for 'u Other comment_id Review comment ID to update or delete. Use the CommentID field from get_review_comments. (number, required) Other commentId The ID of the comment to reply to. Use the CommentID field from get_review_comments. (number, required) Other commit_title Title for merge commit (string, optional) Other commitID SHA of commit to review (string, optional) Other direction The direction to sort the results by. (string, optional) Other gist_id ID of the gist to update (string, required) Other issue_number The issue number (use when item_type is 'issue' for 'add_project_item' method). Provide either issue_number or Other item_type The item's type, either issue or pull_request. Required for 'add_project_item' method. (string, optional) Other job_id The unique identifier of the workflow job. Required when getting logs for a single job. (number, optional) Other message Commit message (string, required) Other new_name New name for the label (used only with 'update' method to rename) (string, optional) Other owner_type Owner type (user or org). If not provided, will be automatically detected. (string, optional) Other perPage Results per page for pagination (min 1, max 100) (number, optional) Other private Whether repo should be private (boolean, optional) Other reason Reason for locking the worktree (optional) (string, optional) Other remote Remote name (default: origin) (string, optional) Other reviewers GitHub usernames to request reviews from (string[], optional) Other run_id The unique identifier of the workflow run. Required when failed_only is true to get logs for all failed jobs i Other side The side of the diff to comment on. LEFT indicates the previous state, RIGHT indicates the new state (string, Other start_date The start date of the status update in YYYY-MM-DD format. Used for 'create_project_status_update' method. (str Other startLine For multi-line comments, the first line of the range that the comment applies to (number, optional) Other startSide For multi-line comments, the starting side of the diff that the comment applies to. LEFT indicates the previou Other state_reason Reason for the state change. Ignored unless state is changed. (string, optional) Other status The status of the project. Used for 'create_project_status_update' method. (string, optional) Other sub_issue_id The ID of the sub-issue to add. ID is not the same as issue number (number, required) Other subjectType The level at which the comment is targeted (string, required) Other tag Tag name (string, required) Other target_date The target date of the status update in YYYY-MM-DD format. Used for 'create_project_status_update' method. (st Other threadID The ID of the notification thread (string, required) Other updated_field Object consisting of the ID of the project field to update and the new value for the field. To clear the field Other verbose Show verbose output (optional, default: false) (boolean, optional) Other workflow_id The workflow ID (numeric) or workflow file name (e.g., main.yml, ci.yaml). Required for 'run_workflow' method. Other worktree Path to the worktree directory to unlock (string, required) Other worktree_path Path where the new worktree should be created (string, required)
EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

UnClick 1658 tools
adminautomation
Nodebench 824 tools
adminautomation
Yaver 812 tools
adminautomation
Binance MCP Server 734 tools
adminautomation
Crow 587 tools
adminautomation
Fortimanager 584 tools
adminautomation
TinyFn 572 tools
adminautomation
Mcp 571 tools
adminautomation
FAQ

Questions about GitHub

Can an AI agent delete data through the GitHub MCP server? +

Yes. The GitHub server exposes 5 destructive tools including delete_file, force, git_reset. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through GitHub? +

The GitHub server has 48 write tools including add_comment_to_pending_review, add_issue_comment, add_reply_to_pull_request_comment. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach GitHub.

How many tools does the GitHub MCP server expose? +

245 tools across 4 categories: Destructive, Execute, Read, Write. 143 are read-only. 102 can modify, create, or delete data.

How do I enforce a policy on GitHub? +

Register the GitHub MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every GitHub tool call.

Deterministic rules across all 245 GitHub tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON GITHUB →

Instant setup, no code required.

245 GitHub tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from GitHub's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.